Failure limit on tx proposals

[NotGyro]

• Detects when a client has submitted excessive invalid tx proposals within a configurable rolling window
• Adds tx_failure_window and tx_failure_limit fields to the consensus service config Rust structure (for use with clap).
• Adds tx_failure_window_seconds and tx_failure_limit, as well as previously-missed client_tracking_capacity to the ConsensusNodeConfig protobuf, and amends get_node_config to add those values to that configuration export.

Motivation

This will be used to track how many failed tx proposals have been sent recently, so that bad connections can be dropped, to prevent attacks and harmful behavior from buggy clients. See: #2977

Future Work

• Test case to ensure client_close() actually prevents additional wasted work (i.e. breaks auth for the client such that they need to re-authenticate before any other work can be passed to the enclave).
• Slam-testing to determine reasonable defaults for tx_failure_window and tx_failure_limit

[NotGyro]

• Failure limit on tx proposals #3296 👈
• Track failed tx proposals in consensus #3208
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @NotGyro and the rest of your teammates on Graphite

[nick-mobilecoin]

❌ this looks like it might have a merge issue, it seems to be diffing against other changes that are present in the mainline branch master.

[NotGyro]

x this looks like it might have a merge issue, it seems to be diffing against other changes that are present in the mainline branch master.

Yes, I'm not sure how best to resolve that.

The only files modified are consensus_config.proto, consensus/service/config/src/lib.rs, consensus/service/src/api/client_api_service.rs, and that is correct.

However, I do see all of those unrelated commits. I may have messed up rebasing to keep up-to-date with the main branch.

[nick-mobilecoin]

🙃 Don't think "least recently used" is a hyphenated word

Suggest looking at my comment on "denial-of-service" before deciding

Suggested change

	// a least-recently-used cache.
	// a least recently used cache.

[nick-mobilecoin]

❓ I don't think it matters as they're all dynamically sized, but why uint64 here? Considering tx_failure_limit is uint32

[nick-mobilecoin]

👍 Like the call out of the units in the name since there is no type safety.

[nick-mobilecoin]

💭 interestingly "denial-of-service" is often hyphenated on the interwebs. It looks like the rules are pretty loose when to hyphenate, some say since "denial-of-service" is a compound adjective it can be hyphenated.

[nick-mobilecoin]

🔧 Is this name correct? Also getter setter methods should avoid get_ prefix

Suggested change

	pub fn get_proposetx_failures(&self) -> usize {
	pub fn num_tx_proposal_failures(&self) -> usize {

While the usize uses communicates the type, I used "num" to indicate it wasn't the actual field itself.

[nick-mobilecoin]

🔧 I usually lean on the 3 strike rule:

1. you're writing code
2. It might be coincidence that the logic is duplicate
3. You're out, refactor.

This is the 3rd time this patter of if get() else put() && get() has been present. This should have method which does this for you.
Unfortunately due to the mutex this will be a little bit more work as it will need to return a session guard that implements drop, to free up the mutex.

[nick-mobilecoin]

❓ Thoughts on using a match statement here?
Something about seeing is_err logic and then in a separate block modifying that error.

[nick-mobilecoin]

🔧 Thinking is_err() would work here since the contents don't appear to be looked at

Suggested change

	if let Err(_err) = &result {
	if result.is_err() {

[nick-mobilecoin]

🔧 it might lose a little bit of info on failures but perhaps

Suggested change

	assert!(propose_tx_response.is_err());
	match propose_tx_response {
	Err(grpcio::Error::RpcFailure(rpc_status)) => {
	assert_eq!(rpc_status.code(), RpcStatusCode::RESOURCE_EXHAUSTED);
	}
	_ => panic!(
	"Unexpected response upon continuing to use\
	a rate-limited session: {propose_tx_response:?}"
	),
	}
	assert!(
	matches!(propose_tx_response, Err(grpcio::Error::RpcFailure(failure)) if failure.code() == RpcStatusCode::RESOURCE_EXHAUSTED)
	);

[nick-mobilecoin]

🔧 it doesn't seem like this comment is needed since the tracker will close it.

Suggested change

	// Because of the behavior of Mockall, if this returns without calling
	// client_close() exactly once, it will panic and the test will fail.