Harden the P2P layer for open (permissionless) networks; 0.1.7 and 0.1.8

[xdagx]

Summary

The P2P layer, hardened so that it can face peers nobody vouches for. This is the precondition for removing the node whitelist in xdagj: XDagger/xdagj#363 depends on this pull request.

Two versions in one branch:

• 0.1.7 - security hardening. The wire protocol changes (frame version 2, mutual handshake, signed discovery): 0.1.7 and later do not talk to 0.1.6 and earlier.
• 0.1.8 - two start-up fixes found while testing xdagj on top of 0.1.7. Same on the wire as 0.1.7.

CHANGELOG.md has the full list. The reasoning behind each change is in xdagj's docs/SECURITY_AUDIT_OPEN_NETWORK.md (findings P1-P16), which is part of XDagger/xdagj#363.

0.1.7

• Signed discovery with endpoint proof. Every discovery datagram is signed with the node key; the sender's identity is recovered from the signature and has to match the id the packet claims. A node enters the table, is dialled, or gets FIND_NODE answered only after it answered one of our pings.
• Mutual handshake. Both sides issue a nonce; a recorded handshake cannot be replayed; self-connections are detected.
• Admission control before any handler sees a byte: bans enforced on inbound connections; limits on total, inbound, pending-handshake, per-IP and per-subnet connections; a closed-network mode in which only configured peers are talked to (P2pService.setPermissionless).
• Bounds and backpressure. Counts read off the wire are checked before anything is allocated; strict frame codec; rate limits before signature verification; inbound byte-rate guard and outbound queue bound.
• Fixes: ban duration overflow, Channel.send(Bytes) writing unframed bytes, node ids of discovery and handshake never matching (which defeated duplicate-connection detection), getConnectableNodes() returning unverified nodes, PeerClient.connect(host, port) blocking until the connection closed.
• ReputationManager no longer uses Java serialisation; P2pConfig performs no network access on construction.

0.1.8

• P2pService.start() returns when the TCP listener and the discovery socket are bound. It used to return while they were still coming up on their own threads: a node started right after another dialled too early and connected 30 s later, and an early stop() left the socket open for the life of the process.
• P2pService.setPermissionless() may be called before start(); it then only changes the setting (it used to run the connect loop on a service that was not running: a NullPointerException, logged as a warning).

Compatibility

• Not wire-compatible with 0.1.6 (see above). Applications define their messages at codes 0x20 and above, as before.
• New configuration (all optional, defaults keep the node open): permissionless, bindIp, connection limits, allowPrivateAddresses; see the "Added" section of the changelog.

Testing

• mvn test: 923 tests, 0 failures. Two tests need internet access and are skipped without it.
• New adversarial tests: signed / tampered / foreign-network / unsigned datagrams, oversized packets, neighbour counts on the wire, interleaved and overlong frames, handshake replay and identity binding, rate limits, table limits; two services on the loopback interface for the start-up fixes.
• Coverage measured for this branch (JaCoCo, example package excluded): 75.5% of instructions, 59.8% of branches. The README carries the new figures; they are lower than before because the code grew by about a quarter.
• mvn license:check passes.

Notes for reviewers

• The branch is based on master. develop is currently 7 commits behind master (dependency updates), so until develop is brought up to master this pull request also lists those commits.
• xdagj 0.9.0 depends on io.xdag:xdagj-p2p:0.1.8: Open network: remove the node whitelist, harden consensus behind a fork; 0.9.0 xdagj#363 cannot build in CI until 0.1.8 is published.

🤖 Generated with Claude Code