Zebra should limit the number of addresses it uses from a single Addrs response, to avoid address book takeover

[teor2345]

Motivation

Zebra accepts up to 1000 addresses from each peer address request. But the Zcash mainnet only has around 200 peers, and the peerset_initial_target_size defaults to 75.

These limits will be particularly important once we limit the size of the address book (#1873), so that peers can't flood or replace our entire address book.

Solution

Zebra should limit the number of peers it accepts in response to each peer request.

Zebra should choose peers from each peer request using the following algorithm:

• take peerset_initial_target_size / 2 peers at random, and leave the rest in the connection peer cache

These designs have security implications, so we shouldn't do them:

• remove addresses that are already in the address book this can be exploited to fill the address book with new malicious addresses
• sort peers by their untrusted_last_seen_time, newest first choosing peers based on untrusted data makes it easier to add new malicious addresses
• Increase the default crawl_and_dial interval, to compensate for the peers we're discarding we already crawl in response to unmet demand, so this isn't needed

This algorithm makes it much less likely that a majority of Zebra's peers will come from a single peer request, while also limiting the number of extra peer requests that Zebra makes.

Context

zcashd does not have this issue.

[teor2345]

This doesn't affect remote nodes, so it's not a critical security issue.

[teor2345]

zcashd has a very strict rate limit on addr responses. So we can't implement this ticket, because we might discard useful addresses, and never get them back. This is a particular issue on testnet, but it could also happen to mainnet nodes with a small number of initial peers.

Instead, we could eventually implement the DNS seeder retries in #1892.

For the moment, our current peer prioritisation should be good enough to avoid most of these issues, particularly after we limit the address book size in #1873.

[teor2345]

Might be needed for #7824