tari-project / tari / 38729932013

77%

Build Type

push

github

Committed by web-flow

Commit Message

fix(comms): lossless peer DB addresses, row cap and GC, direction-aware reaper, persisted bans (#8124)

## Description

Hardening of the comms connectivity reaper and peer database (SPEC-C of
the 2026-10-07 `tari_comms` audit, findings W3, W4 reaper half, W5, W12,
W21, W22, W24, W25).

Before this PR:
- **Poisoned rows broke every peer query, and the break survived
restarts.** A single claimed address with a `/` in its DNS name was
stored as text that no longer parsed. One such row made every peer DB
query fail, isolating the node.
- **The peer table grew without bound.** Identities are free, and dial
selection was uniform random over the whole table.
- **Inbound Sybils could evict honest outbound connections.** The reaper
counted inbound connections against its outbound threshold.
- **Handshake bans for unknown keys were silently lost.**

Wire-compatible: the identity message, the claim signature and the
address encoding on the wire are unchanged.

### Changes
- **Lossless address storage** (`peer_manager/storage`).
- New migration `2026-10-08-000000_address_bytes` adds `address_bytes`
(BLOB) and `netgroup` columns, plus indexes.
- A one-off data step, versioned in `db_metadata`, fills them in and
deletes rows that don't decode. It also deletes non-config rows whose
address, or any address in their stored claim, fails the shape check.
- All reads decode from bytes and skip a bad row with a warning and a
metric, instead of failing the whole query.
- Stored claims keep the existing text form, so an older node can still
read the DB after a downgrade. Addresses whose text form doesn't
round-trip are never written.
  - `size()` is now a `COUNT`, and limits moved into SQL.
- **DNS name validation** (`peer_validator`).
- A `/` in a DNS name (text round-trip failure) is still
`InvalidMultiaddr`, a ban offence.
- The new label rules are filter-only: the address is dropped, with no
ban and no hostile-relay count. They reject non-LDH characters,
over-long label... (continued)

Coverage Stats

2364 of 2408 new or added lines in 25 files covered. (98.17%)

449 existing lines in 23 files now uncovered.

130362 of 172533 relevant lines covered (75.56%)

312394.37 hits per line