Skip to content

gossipsub: downscore peers on protocol violations - #735

Open
gmelodie wants to merge 2 commits into
libp2p:masterfrom
vacp2p:chore/downscore-peers
Open

gossipsub: downscore peers on protocol violations#735
gmelodie wants to merge 2 commits into
libp2p:masterfrom
vacp2p:chore/downscore-peers

Conversation

@gmelodie

Copy link
Copy Markdown
Contributor

Follow-up to #729 (comment), where @MarcoPolo asked for a separate PR.

The Topic Streams Extension says a receiver SHOULD downscore a peer for some spec violations. Other gossipsub documents state MUST and MUST NOT conditions without saying what a receiver does when a peer breaks them. This PR states the consequence once, in the extensions framework document, and applies it where an extension needs a specific rule.

gossipsub-v1.3.md gets a new "Peer Scoring on Protocol Violations" section:

  • A peer that sends a message which violates a MUST or MUST NOT condition SHOULD be downscored through the P₇ behavioural penalty from gossipsub v1.1.
  • The rule covers only the conditions that a receiver can check from the messages it receives. It does not cover the process rules of this document, such as the requirement to update extensions.proto.
  • An extension MAY define a stronger remedy, such as a connection reset. This keeps the rule compatible with gossipsub: Topic Streams Extension #729, which resets the connection and sends an error code.
  • A receiver MUST NOT downscore a peer for a message that the peer could have sent before it processed the receiver's latest subscription change. gossipsub: Topic Streams Extension #729 carves out the same race for topic streams. Without it, a node that unsubscribes penalises every honest peer with a message already on the wire.

The Extensions control message rules now state their consequence: a receiver SHOULD downscore a peer that sends the message after the first message on the stream, or sends more than one.

partial-messages.md points at the v1.3 section, and states the one rule that needs the extension's own terms: a node that receives a partialMessage field for a topic it did not request partial messages on SHOULD downscore the sending peer, unless the peer could have sent it before processing the node's latest SubOpts for that topic.

Two documents are left alone on purpose. gossipsub-v1.1.md already owns the scoring machinery, and adding a blanket penalty rule to it is a semantic change rather than an editorial one. extensions/experimental/test-extension.md exists to test interop, so a penalty there is noise.

@gmelodie
gmelodie marked this pull request as ready for review August 24, 2026 16:18
@gmelodie

Copy link
Copy Markdown
Contributor Author

@MarcoPolo I cannot tag you as a reviewer as you asked, but here you go :)

@MarcoPolo MarcoPolo left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good. Please update the revision number at the top


To prevent DoS the number of `IDONTWANT` control messages is limited to `max_idontwant_messages` per heartbeat

The receiver SHOULD ignore the `IDONTWANT` messages beyond `max_idontwant_messages` within a heartbeat, and SHOULD

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please update the revision number at the top

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Triage

Development

Successfully merging this pull request may close these issues.

2 participants