Return early in IsBanned. #10564

I am not aware of any reason that we'd try to stop a ban-list timing side-channel and the prior code wouldn't be enough if we were.

utACK bf376eaccc892afb7ded1a56819a72dd50a7a2c1

Curious, what else would you do to previous code if you did want to stop a side channel attack?

@ryanofsky to make this constant time:

Change the conditional to use bit operations instead:

fResult |= fsubNet.Match(ip) & (GetTime() < banEntry.nBanUntil)

Make the match constant time (which would probably involve similar transforms in it).

and

Replace the set with a vector with either a fixed number of entries or a size that is quantized to some interval. (E.g. multiples of 1024 entries)... so that it always loops over the same number of entries.

Though I'm not sure why we really would care to hide the size of our banlist. :)

Though I'm not sure why we really would care to hide the size of our banlist. :)

Thanks, I was just curious how you would go about something like this. I kind of figured the set lookup would have to change in some way, but I didn't think about the short circuiting operations at all. Interesting!

utACK bf376eaccc892afb7ded1a56819a72dd50a7a2c1

utACK bf376eaccc892afb7ded1a56819a72dd50a7a2c1