{
 "number": 35874,
 "repo": "bitcoin/bitcoin",
 "url": "https://github.com/bitcoin/bitcoin/pull/35874",
 "title": "p2p: prevent BIP35 requesters from bypassing inbound tx-relay capacity",
 "author": "l0rinc",
 "author_association": "MEMBER",
 "created_at": "2026-08-03T23:55:10Z",
 "updated_at": "2026-09-16T18:19:35Z",
 "age_days": 44,
 "draft": false,
 "labels": [
  "P2P"
 ],
 "milestone": null,
 "base": "master",
 "head_sha": "fc657d872f75e29130957af9b94e1c72119c1a5e",
 "head_ref": "l0rinc/bip35-relay-capacity",
 "head_repo": "l0rinc/bitcoin",
 "head_history": [
  {
   "t": "2026-08-04T05:14:32Z",
   "sha": "67269048e40bc9edcdb9192cfe57e221cf1ed09d"
  },
  {
   "t": "2026-08-04T05:24:40Z",
   "sha": "dd1af38900acd0fdd79ae3ad5239cea04a603d2e"
  },
  {
   "t": "2026-08-04T23:00:23Z",
   "sha": "c7460a26d22b38d43cf8f80c3bd405308722def1"
  },
  {
   "t": "2026-08-05T06:29:42Z",
   "sha": "760da863d9609a0c5fbb29846cae90aa56919511"
  },
  {
   "t": "2026-08-15T04:24:50Z",
   "sha": "fc657d872f75e29130957af9b94e1c72119c1a5e"
  }
 ],
 "additions": 26,
 "deletions": 2,
 "changed_files": 3,
 "commit_count": 2,
 "size_bucket": "S",
 "mergeable_state": "clean",
 "bot": {
  "drahtbot": {
   "present": true,
   "reviews": {},
   "conflicts": [
    {
     "number": 34824,
     "title": "net: encapsulate TxRelay state and replace recursive mutexes",
     "author": "w0xlt"
    }
   ]
  }
 },
 "acks_parsed": {},
 "acks_tally": {
  "ack": 0,
  "stale_ack": 0,
  "concept_ack": 0,
  "approach_ack": 0,
  "nack": 0,
  "concept_nack": 0,
  "approach_nack": 0
 },
 "reviews": {
  "approved": 0,
  "changes_requested": 0,
  "distinct_reviewers": [
   "darosior",
   "gmaxwell",
   "schildbach"
  ]
 },
 "signals": {
  "needs_rebase": false,
  "ci_failed": false,
  "mergeable_state": "clean",
  "last_author_activity": "2026-08-15T04:34:25Z",
  "last_reviewer_activity": "2026-08-13T09:38:44Z",
  "last_reviewer": "schildbach",
  "author_silent_days": 33,
  "waiting_on_author_days": 0,
  "days_since_update": 0
 },
 "refs": {
  "mentioned": [
   28463
  ],
  "depends_on": [],
  "fixes": [],
  "linked_issues": [],
  "references": [
   {
    "number": 28463,
    "type": "pull",
    "state": "closed",
    "merged": true,
    "merged_at": "2026-07-24",
    "title": "p2p: Increase inbound capacity for block-relay only connections"
   }
  ],
  "conflicts": [
   34824
  ]
 },
 "stack": {
  "shares_commits_with": [],
  "based_on": [],
  "base_for": []
 },
 "review_paths": [
  "src/net_processing.cpp"
 ],
 "body": "**Problem:** When a node offers `NODE_BLOOM`, an inbound peer can advertise `fRelay=false` and request BIP35 mempool inventory while remaining outside the inbound transaction-relay capacity introduced in [#28463](https://github.com/bitcoin/bitcoin/pull/28463).\n\n**Fix:** Ignore `mempool` requests while the peer has transaction relay disabled, unless the connection has the `mempool` permission.\nA BIP37 `filterload` message enables transaction relay and applies the existing capacity limit, preserving bitcoinj's [SPV `filterload`-then-`mempool` sequence](https://github.com/bitcoin/bitcoin/pull/35874#issuecomment-5278621654).\nTargeted `getdata` requests remain unchanged.",
 "commits": [
  {
   "sha": "f4bb34381a33758d2f49a5917657dcc9e6790567",
   "date": "2026-08-15T04:23:16Z",
   "message": "test: characterize BIP35 before tx relay\n\nAn inbound peer with `fRelay=false` currently receives BIP35 inventory before enabling transaction relay.\nThe adjacent BIP37 test covers the bitcoinj SPV sequence by sending `filterload` before `mempool`."
  },
  {
   "sha": "fc657d872f75e29130957af9b94e1c72119c1a5e",
   "date": "2026-08-15T04:23:16Z",
   "message": "p2p: require tx relay for BIP35 requests\n\nIgnore BIP35 `mempool` requests while transaction relay is disabled, unless the connection has the `mempool` permission.\n\nA BIP37 `filterload` message enables relay and applies the existing inbound capacity limit before bitcoinj's SPV flow sends `mempool`.\nTargeted `getdata` requests remain unchanged."
  }
 ],
 "timeline": [
  {
   "t": "2026-08-04T05:14:32Z",
   "kind": "force_push",
   "who": "l0rinc",
   "commit": "67269048e40bc9edcdb9192cfe57e221cf1ed09d"
  },
  {
   "t": "2026-08-04T05:24:40Z",
   "kind": "force_push",
   "who": "l0rinc",
   "commit": "dd1af38900acd0fdd79ae3ad5239cea04a603d2e"
  },
  {
   "t": "2026-08-04T17:25:40Z",
   "kind": "review_comment",
   "who": "darosior",
   "assoc": "MEMBER",
   "path": "src/net_processing.cpp",
   "commit": "760da863d9609a0c5fbb29846cae90aa56919511",
   "in_reply_to": null,
   "text": "I think that's a protocol change? Prior to this we would not flood a peer that set BIP 37 `fRelay` to `false` with INV's until they set a filter. After this change, we would flood them with non-filtered INV's provided they previously sent a MEMPOOL message."
  },
  {
   "t": "2026-08-04T20:15:35Z",
   "kind": "review_comment",
   "who": "l0rinc",
   "assoc": "MEMBER",
   "path": "src/net_processing.cpp",
   "commit": "760da863d9609a0c5fbb29846cae90aa56919511",
   "in_reply_to": 3714751926,
   "text": "Valid question. If I understood your objection correctly, it applies to `TxRelay::m_relay_txs`, while we're changing `CNode::m_relays_txs`. To make sure, I added a test that requests a BIP35 snapshot and verifies that a transaction added afterward is announced to a regular relay peer but not to the requester. It passes before and after the production change. Could you please check whether it satisfies your criterion? Thanks for the hint."
  },
  {
   "t": "2026-08-04T23:00:23Z",
   "kind": "force_push",
   "who": "l0rinc",
   "commit": "c7460a26d22b38d43cf8f80c3bd405308722def1"
  },
  {
   "t": "2026-08-05T06:29:42Z",
   "kind": "force_push",
   "who": "l0rinc",
   "commit": "760da863d9609a0c5fbb29846cae90aa56919511"
  },
  {
   "t": "2026-08-12T23:31:23Z",
   "kind": "comment",
   "who": "gmaxwell",
   "assoc": "CONTRIBUTOR",
   "text": "Should fRelay=false be able to request inventory at all?   Do any existing pieces of software do this (outside of surveillance software, of course)?\n\nI think it probably shouldn't be allowed.  Historically fRelay=false peers have been treated as a reduced bandwidth and surveillance privacy risk, but I think that's mooted if they're doing mempool requests."
  },
  {
   "t": "2026-08-13T03:25:51Z",
   "kind": "comment",
   "who": "l0rinc",
   "assoc": "MEMBER",
   "text": "Thanks @gmaxwell.\n\n[quoted text omitted]\nI'm not sure about the details, my goal was to close a potential DoS angle.\nA quick search (and some AI tutoring) turned up bitcoinj, it seems that in SPV mode with Bloom filtering, bitcoinj [sets `fRelay=false`](https://github.com/bitcoinj/bitcoinj/blob/643c59d4e20aac9f9112f72b843abf5f57f59625/core/src/main/java/org/bitcoinj/core/PeerGroup.java#L721-L731), then [sends `filterload` before `mempool`](https://github.com/bitcoinj/bitcoinj/blob/643c59d4e20aac9f9112f72b843abf5f57f59625/core/src/main/java/org/bitcoinj/core/Peer.java#L1711-L1738). I'm not sure whether this is the case you had in mind.\n\nThis suggests ignoring non-permissioned `mempool` requests until the peer enables transaction relay, for example by sending `filterload`. @msgilligan, is that accurate? Does bitcoinj ever send `mempool` without first loading a filter?"
  },
  {
   "t": "2026-08-13T09:38:44Z",
   "kind": "comment",
   "who": "schildbach",
   "assoc": "CONTRIBUTOR",
   "text": "[quoted text omitted]\n\nHistorically, bitcoinj has walked the tx dependency chain for its risk analysis. It uses `getdata` messages for this.\n\n[quoted text omitted]\nIn the SPV case (which I assume is what you care about in this context), bitcoinj sets the filter first via `filterload`, then immediately follows up with `mempool`.\n\n(Afaicr, we never used the ability to set a new filter for a connection, or add data to one. Rather, we drop the connection and build a new one.)"
  },
  {
   "t": "2026-08-15T04:24:50Z",
   "kind": "force_push",
   "who": "l0rinc",
   "commit": "fc657d872f75e29130957af9b94e1c72119c1a5e"
  },
  {
   "t": "2026-08-15T04:34:25Z",
   "kind": "comment",
   "who": "l0rinc",
   "assoc": "MEMBER",
   "text": "Rebased and reworked this based on the review feedback. The PR now ignores non-permissioned `mempool` requests while tx relay is disabled, preserving existing BIP37 and targeted `getdata` behavior.\nThanks @gmaxwell and @schildbach for helping clarify the intended behavior and guiding this toward a simpler solution."
  }
 ],
 "labels_log": [
  {
   "t": "2026-08-03T23:55:13Z",
   "action": "labeled",
   "label": "P2P",
   "who": "DrahtBot"
  },
  {
   "t": "2026-08-04T05:25:09Z",
   "action": "labeled",
   "label": "CI failed",
   "who": "DrahtBot"
  },
  {
   "t": "2026-08-04T15:44:52Z",
   "action": "unlabeled",
   "label": "CI failed",
   "who": "DrahtBot"
  },
  {
   "t": "2026-08-05T07:55:07Z",
   "action": "labeled",
   "label": "CI failed",
   "who": "DrahtBot"
  },
  {
   "t": "2026-08-05T19:31:42Z",
   "action": "unlabeled",
   "label": "CI failed",
   "who": "DrahtBot"
  }
 ],
 "state_log": [
  {
   "t": "2026-08-04T01:13:15Z",
   "kind": "ready_for_review",
   "who": "l0rinc"
  },
  {
   "t": "2026-08-04T05:16:31Z",
   "kind": "renamed",
   "who": "l0rinc",
   "from": "p2p: account BIP35 requests against relay capacity",
   "to": "p2p: enforce relay limit for BIP35 requesters"
  },
  {
   "t": "2026-08-04T14:09:08Z",
   "kind": "closed",
   "who": "DrahtBot"
  },
  {
   "t": "2026-08-04T14:09:15Z",
   "kind": "reopened",
   "who": "DrahtBot"
  },
  {
   "t": "2026-08-05T06:30:08Z",
   "kind": "renamed",
   "who": "l0rinc",
   "from": "p2p: enforce relay limit for BIP35 requesters",
   "to": "p2p: prevent BIP35 requesters from bypassing inbound tx-relay capacity"
  },
  {
   "t": "2026-08-05T18:08:43Z",
   "kind": "closed",
   "who": "l0rinc"
  },
  {
   "t": "2026-08-05T18:08:46Z",
   "kind": "reopened",
   "who": "l0rinc"
  }
 ],
 "text_chars": 4072,
 "text_tokens_estimate": 1018,
 "changed_paths": [
  "src/net_processing.cpp",
  "test/functional/p2p_connection_limits.py",
  "test/functional/p2p_filter.py"
 ],
 "files": [
  {
   "path": "src/net_processing.cpp",
   "add": 3,
   "del": 0
  },
  {
   "path": "test/functional/p2p_connection_limits.py",
   "add": 17,
   "del": 1
  },
  {
   "path": "test/functional/p2p_filter.py",
   "add": 6,
   "del": 1
  }
 ],
 "test_lines": 25,
 "git": {
  "head": "fc657d872f75e29130957af9b94e1c72119c1a5e",
  "head_matches_backup": true,
  "base": "a8b582ec1d25e012731fcca122552b59f8967610",
  "commits": [
   {
    "sha": "f4bb34381a",
    "subject": "test: characterize BIP35 before tx relay",
    "files": 2,
    "add": 23,
    "del": 2
   },
   {
    "sha": "fc657d872f",
    "subject": "p2p: require tx relay for BIP35 requests",
    "files": 2,
    "add": 4,
    "del": 1
   }
  ],
  "patch_truncated": false
 },
 "input_hash": "687afab081dd44bd",
 "extracted_at": "2026-09-17T16:15:31+00:00"
}