Skip to content

kip-311: align the P2P rules with the v3.0.0-rc.3 client - #138

Open
2dvorak wants to merge 11 commits into
kaiachain:mainfrom
2dvorak:draft/kip-311-rc3-v2
Open

2dvorak wants to merge 11 commits into
kaiachain:mainfrom
2dvorak:draft/kip-311-rc3-v2

Conversation

@2dvorak

@2dvorak 2dvorak commented Oct 20, 2026

Copy link
Copy Markdown
Contributor

Proposed changes

  • A CN that leaves CNPeers drops none of its own CN peers; a CN keeps an EN slot for its own dial; a disconnect over an invalid VRank message leaves CNPeers unchanged.
  • R7: the CN-side floor and budget keep an outside CN dialing ENs but do not make an EN accept it.
  • A CN applies the CNPeers of the block following its head; static-nodes.json grants no inbound CN authorization in either period.
  • A rejected candidate retries after the 30-second dial backoff; lookups run on dial demand and a periodic refresh; the BN answers FINDNODE from its whole table and rate-limits pings per source IP; admission checks membership, not the peer's implementation.

Types of changes

Please put an x in the boxes related to your change.

  • Bugfix
  • KIP Proposal
  • KIP Improvement

Checklist

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.

  • Used the suggested template: https://github.com/kaiachain/KIPs/blob/main/kip-template.md
  • I have read the CLA and signed by comment I have read the CLA Document and I hereby sign the CLA in first time contribution
  • I have added necessary documentation (if appropriate)
  • Any dependent changes have been merged and published in downstream modules

Related issues

Further comments

2dvorak and others added 10 commits October 20, 2026 02:35
The client reconciles by dropping each non-exempt CN peer whose address
is no longer in CNPeers. A CN that leaves CNPeers still sees its peers
in the set, so it drops none of them; the links close when each peer
observes the transition and drops the leaver. State that instead of a
SHOULD the client does not follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
peerTargets[CN][EN] counts inbound and outbound EN peers together, while
dialTargets[CN][EN] counts only outbound ones, so inbound ENs alone could
fill the cap and leave the CN unable to dial its own EN. The client caps
non-exempt inbound EN peers below peerTargets[CN][EN] by
dialTargets[CN][EN], clamped to leave one inbound slot. No KIP text
described this rule. An EN has no such reserve, since its CN cap equals
its CN dial target.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
KIP-227 lets a CN disconnect a peer that sent an invalid VRank message.
Such a disconnect leaves CNPeers unchanged, since membership follows
AddressBookV2 state alone, and the CN re-dials the peer on the normal R3
schedule, so dropping the link never changes mesh membership.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
R7 promised block-sync availability for a CN outside the mesh from the
CN's own dial floor and budget, but the dial only succeeds if some EN
has a free CN slot. An EN's two default CN slots match its two CN dial
targets, so its own dials fill them, and an EN never drops a CN that
left CNPeers. State what the CN-side rules guarantee and what they do
not.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The activation section said that before the fork static-nodes.json
still grants inbound CN authorization. A v3 client checks inbound CN
peers against the permissioned council before the fork and against
CNPeers after it; static configuration exempts only the node's own
outbound dials in both periods, as the glossary already states.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
R4 and R6 speak of CNPeers changing without saying which block's set a
CN uses. The client evaluates the set for the block it is about to
build, so a demotion applied by block b removes the node from the mesh
when peers reach head b-1, one block before AddressBookV2 state at the
head reflects it. State the view so readers and tests do not wait for
the state read.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The race section said the cost of refusing a grace window is a
sub-second retry. No client version retries that fast: a failed dial
puts the node ID under a 30-second backoff, and that interval was the
same before and after the dialer rewrite. The other half of the cost
is missing as well: the rejecting CN dials every `CNPeers` member, so
it re-forms the link itself once its discovery table admits the
candidate's entry. State the real cost so the no-grace-window decision
is weighed against tens of seconds, not sub-second.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
R3 required a node to start extra lookups whenever its table held
fewer than `discoverTargets` entries of a type. No such count-based
trigger exists: the dialer asks for a table refresh when a type's
candidate queue cannot cover its outbound need, and the table refreshes
itself on a fixed interval. The target sizes the lookup and switches
discovery of a type on or off; nothing compares the table size to it.
Describe the two real triggers and keep the entry floor as it was.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The compatibility note predicted that a node which does not implement
R4 would be rejected on CN-claimed connections and could not join the
mesh. No admitting CN can perform that check: the handshake carries the
peer's claimed type, identity, name and capabilities, and nothing
signals whether the peer applies R4 itself. What a CN checks is its
own rule set against the peer's `CNPeers` membership, so a member that
skips R4 is admitted and a non-member claiming CN is rejected however
it behaves. State the rule in those terms.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
R2 asked a BN for random neighbor selection and for a ping rate limit
keyed on unknown NodeIds. Neither matches how a BN answers. A FINDNODE
reply is drawn from the BN's whole table for the requested type: CN,
PN and BN entries are a uniform random sample, EN entries are the
closest by the discovery distance rule. The ping limiter is keyed on
the source IP, not the NodeId, because a NodeId can be replayed from a
spoofed address and would let a flood through, and LAN sources are
exempt so co-located nodes behind one address do not throttle each
other. The client's BN turns the limit on by default and exposes an
operator option that tunes or disables it. Align R2, the change
summary and the security note with that behaviour.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@2dvorak 2dvorak self-assigned this Oct 20, 2026
@2dvorak
2dvorak marked this pull request as ready for review October 20, 2026 11:45
CNPeers of block N reflects the system transitions at the start of N, so
only those take effect one block early. A user transaction in block b is
in the state after b and reaches the mesh at head b.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant