[MysticRyuujin]

Issue Addressed

#10567

Proposed Changes

boot_node now sets its own discv5 packet filter limits after set_network_config. Before, it used the beacon node defaults from lighthouse_network::Config::default().

• Global limit for unsolicited packets: 100 per second instead of 10. On a public mainnet boot node the pre-filter rate is 14 to 15 per second, and about 20% of discv5 PINGs got no reply. 100 gives about 6.7x headroom. A flood now needs 11 IPs at the per-IP limit to fill the global budget, instead of 2.
• Per-IP (9/s) and per-node (8/s) limits: unchanged. They use the same values as the beacon node defaults. RateLimiter has no setter, so the builder must repeat them.
• filter_max_nodes_per_ip: None instead of Some(10). Node IDs per IP do not expire by time, so the limit bans an IP that many nodes share behind NAT, several times a day (see boot_node: discovery packet filter drops traffic on busy networks and bans shared IPs #10567).
• --disable-packet-filter works as before. The change does not touch enable_packet_filter.

New unit test: boot_node_packet_filter_raises_total_limit_and_allows_shared_ips.

Additional Info

• Tradeoff of None: one IP can now use any number of node IDs, but only within 9 unsolicited packets per second. The per-IP ban, the per-node limit and its ban, max_bans_per_ip (5), and the routing table ip_limit still apply. The header src_id is not authenticated, so the old limit also let 10 spoofed packets ban a victim IP for one hour. A higher fixed number is an alternative if you prefer it, but any fixed number still bans a large NAT.
• The per-IP rate limit also bans for one hour. A NAT IP that sends more than 9 unsolicited packets per second can still be banned. This change does not cover that case.
• The test compares the boot node limiter with the beacon node default through total_requests_per_second(). LimitKind is private to discv5, so a test of the real limiter behaviour would need two live Discv5 instances.
• I prepared this change with an AI coding agent, and I reviewed and tested it.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue). If it does not match the queue conditions yet, it enters the queue once it does.

• Queue this pull request