[net] Ignore getheaders requests for very old side blocks #11113

 724 | @@ -725,6 +725,17 @@ void Misbehaving(NodeId pnode, int howmuch)
 725 |  // blockchain -> download logic notification
 726 |  //
 727 |  
 728 | +// To prevent fingerprinting attacks, only send blocks/headers outside of the
 729 | +// active chain if they are no more than a month older (both in time, and in
 730 | +// best equivalent proof of work) than the best header chain we know about.
 731 | +static bool SideBlockRequestAllowed(const CBlockIndex* pindex, const Consensus::Params& consensusParams)

---

 724 | @@ -725,6 +725,17 @@ void Misbehaving(NodeId pnode, int howmuch)
 725 |  // blockchain -> download logic notification
 726 |  //
 727 |  
 728 | +// To prevent fingerprinting attacks, only send blocks/headers outside of the
 729 | +// active chain if they are no more than a month older (both in time, and in
 730 | +// best equivalent proof of work) than the best header chain we know about.
 731 | +static bool OrphanBlockRequestAllowed(const CBlockIndex* pindex, const Consensus::Params& consensusParams)
 732 | +{
 733 | +    static const int nOneMonth = 30 * 24 * 60 * 60;

---

 724 | @@ -725,6 +725,17 @@ void Misbehaving(NodeId pnode, int howmuch)
 725 |  // blockchain -> download logic notification
 726 |  //
 727 |  
 728 | +// To prevent fingerprinting attacks, only send blocks/headers outside of the
 729 | +// active chain if they are no more than a month older (both in time, and in
 730 | +// best equivalent proof of work) than the best header chain we know about.
 731 | +static bool OrphanBlockRequestAllowed(const CBlockIndex* pindex, const Consensus::Params& consensusParams)

---

  60 | @@ -61,6 +61,14 @@ static std::vector<std::pair<uint256, CTransactionRef>> vExtraTxnForCompact GUAR
  61 |  
  62 |  static const uint64_t RANDOMIZER_ID_ADDRESS_RELAY = 0x3cac0035b5866b90ULL; // SHA256("main address relay")[0:8]
  63 |  
  64 | +/// Age after which an orphan block will no longer be served if requested as
  65 | +/// protection against fingerprinting.

---

  60 | @@ -61,6 +61,14 @@ static std::vector<std::pair<uint256, CTransactionRef>> vExtraTxnForCompact GUAR
  61 |  
  62 |  static const uint64_t RANDOMIZER_ID_ADDRESS_RELAY = 0x3cac0035b5866b90ULL; // SHA256("main address relay")[0:8]
  63 |  
  64 | +/// Age after which an orphan block will no longer be served if requested as
  65 | +/// protection against fingerprinting.
  66 | +static const int ORPHAN_RELAY_AGE_LIMIT = 30 * 24 * 60 * 60;
  67 | +
  68 | +/// Age after which a block is considered historical for purposes of rate
  69 | +/// limiting block relay. Set to one week.

---

1309 | @@ -1310,8 +1310,8 @@ def __repr__(self):
1310 |  class msg_headers(object):
1311 |      command = b"headers"
1312 |  
1313 | -    def __init__(self):
1314 | -        self.headers = []
1315 | +    def __init__(self, headers=None):
1316 | +        self.headers = headers if headers is not None else []

---

 138 | +        # Request for very old orphan block header should now fail
 139 | +        self.send_header_request(orphan_hash, node0)
 140 | +        time.sleep(3)
 141 | +        assert not self.last_header_equals(orphan_hash, node0)
 142 | +
 143 | +        # Verify we can fetch very old blocks and headers on the active chain.

---

   6 | +
   7 | +If an orphan block more than a month old or its header are requested by a peer,
   8 | +the node should pretend that it does not have it to avoid fingerprinting.
   9 | +"""
  10 | +
  11 | +import time

---

 713 | @@ -706,6 +714,16 @@ void Misbehaving(NodeId pnode, int howmuch)
 714 |  // blockchain -> download logic notification
 715 |  //
 716 |  
 717 | +// To prevent fingerprinting attacks, only send blocks/headers outside of the
 718 | +// active chain if they are no more than a month older (both in time, and in
 719 | +// best equivalent proof of work) than the best header chain we know about.
 720 | +static bool OrphanBlockRequestAllowed(const CBlockIndex* pindex, const Consensus::Params& consensusParams)
 721 | +{
 722 | +    return (pindexBestHeader != nullptr) &&

---

 109 | +
 110 | +        orphan_hash = int(block_hashes[-1], 16)
 111 | +
 112 | +        # Check that getdata request for orphan block succeeds
 113 | +        self.send_block_request(orphan_hash, node0)
 114 | +        test_function = lambda: self.last_block_equals(orphan_hash, node0)

---

 130 | +        self.send_header_request(block_hash, node0)
 131 | +        node0.sync_with_ping()
 132 | +
 133 | +        # Request for very old orphan block should now fail
 134 | +        self.send_block_request(orphan_hash, node0)
 135 | +        time.sleep(3)

---

 135 | +        time.sleep(3)
 136 | +        assert not self.last_block_equals(orphan_hash, node0)
 137 | +
 138 | +        # Request for very old orphan block header should now fail
 139 | +        self.send_header_request(orphan_hash, node0)
 140 | +        time.sleep(3)

---

  92 | +        # Generating a chain of 10 blocks
  93 | +        block_hashes = self.nodes[0].generate(nblocks=10)
  94 | +
  95 | +        # Create longer chain starting 2 blocks before current tip
  96 | +        height = len(block_hashes) - 2
  97 | +        block_hash = block_hashes[height - 1]

---

  32 | +    def set_test_params(self):
  33 | +        self.setup_clean_chain = True
  34 | +        self.num_nodes = 1
  35 | +
  36 | +    # Build a chain of blocks on top of given one
  37 | +    def build_chain(self, nblocks, prev_hash, prev_height, prev_median_time):

---