@aztec/p2p 0.0.1-commit.b6e433891 → 0.0.1-commit.b9865e97

package/src/services/peer-manager/peer_manager.ts

@@ -226,20 +226,30 @@ export class PeerManager implements PeerManagerInterface {
   }
 
   /**
-   * Cleans up expired timeouts.
+   * Cleans up expired timeouts and stale failed-auth-handshake entries.
    *
    * When peers fail to dial after a number of retries, they are temporarily timed out.
    * This function removes any peers that have been in the timed out state for too long.
    * To give them a chance to reconnect.
+   *
+   * Also evicts entries from the failed-auth-handshake map whose expiry window has passed.
+   * Without this, peers that probe once and never reconnect would leave their entries in the
+   * map forever, causing an unbounded memory leak.
    */
   private cleanupExpiredTimeouts() {
-    // Clean up expired timeouts
     const now = this.dateProvider.now();
+
     for (const [peerId, timedOutPeer] of this.timedOutPeers.entries()) {
       if (now >= timedOutPeer.timeoutUntilMs) {
         this.timedOutPeers.delete(peerId);
       }
     }
+
+    for (const [id, entry] of this.failedAuthHandshakes.entries()) {
+      if (now - entry.lastFailureTimestamp > FAILED_AUTH_HANDSHAKE_EXPIRY_MS) {
+        this.failedAuthHandshakes.delete(id);
+      }
+    }
   }
 
   /**
@@ -303,15 +313,20 @@ export class PeerManager implements PeerManagerInterface {
    */
   private handleDisconnectedPeerEvent(e: CustomEvent<PeerId>) {
     const peerId = e.detail;
+    const peerIdStr = peerId.toString();
     this.metrics.peerDisconnected(peerId);
-    this.logger.verbose(`Disconnected from peer ${peerId.toString()}`);
-    const validatorAddress = this.authenticatedPeerIdToValidatorAddress.get(peerId.toString());
+    this.logger.verbose(`Disconnected from peer ${peerIdStr}`);
+    const validatorAddress = this.authenticatedPeerIdToValidatorAddress.get(peerIdStr);
     if (validatorAddress !== undefined) {
       this.logger.info(
-        `Removing authentication for validator ${validatorAddress} at peer id ${peerId.toString()} due to disconnection`,
+        `Removing authentication for validator ${validatorAddress} at peer id ${peerIdStr} due to disconnection`,
       );
       this.authenticatedValidatorAddressToPeerId.delete(validatorAddress.toString());
-      this.authenticatedPeerIdToValidatorAddress.delete(peerId.toString());
+      this.authenticatedPeerIdToValidatorAddress.delete(peerIdStr);
+    }
+
+    if (this.peerScoring.getScoreState(peerIdStr) === PeerScoreState.Healthy) {
+      this.peerScoring.removePeer(peerIdStr);
     }
   }
 
@@ -512,6 +527,7 @@ export class PeerManager implements PeerManagerInterface {
       protectedConnections: protectedPeerCount,
       maxPeerCount: this.config.maxPeerCount,
       cachedPeers: this.cachedPeers.size,
+      discv5KadPeers: this.peerDiscoveryService.getKadValues().length,
       ...this.peerScoring.getStats(),
     });
 
@@ -713,6 +729,12 @@ export class PeerManager implements PeerManagerInterface {
       return;
     }
 
+    // Don't dial peers that have exceeded the auth failure threshold
+    if (!this.isNodeAllowedToConnect(peerId)) {
+      this.logger.trace(`Skipping peer ${peerId} due to failed auth handshake attempts`);
+      return;
+    }
+
     const [multiaddrTcp] = await Promise.all([enr.getFullMultiaddr('tcp')]);
 
     this.logger.trace(`Handling discovered peer ${peerId} at ${multiaddrTcp?.toString() ?? 'undefined address'}`);
@@ -939,6 +961,8 @@ export class PeerManager implements PeerManagerInterface {
           `Received auth for validator ${sender.toString()} from peer ${peerIdString}, but this validator is already authenticated to peer ${peerForAddress.toString()}`,
           { ...logData, address: sender.toString() },
         );
+        this.markAuthHandshakeFailed(peerId);
+        this.markPeerForDisconnect(peerId);
         return;
       }
 
@@ -968,14 +992,14 @@ export class PeerManager implements PeerManagerInterface {
     const peerIdStr = peerId.toString();
 
     const existingEntry = this.failedAuthHandshakes.get(peerIdStr);
+    const failureCount = (existingEntry?.count || 0) + 1;
     this.failedAuthHandshakes.set(peerIdStr, {
-      count: (existingEntry?.count || 0) + 1,
+      count: failureCount,
       lastFailureTimestamp: now,
     });
 
     const connections = this.libP2PNode.getConnections(peerId);
     connections.forEach(conn => {
-      // We mark the IP address
       const address = conn.remoteAddr.nodeAddress().address;
       const existingAddressEntry = this.failedAuthHandshakes.get(address);
       this.failedAuthHandshakes.set(address, {
@@ -983,6 +1007,15 @@ export class PeerManager implements PeerManagerInterface {
         lastFailureTimestamp: now,
       });
     });
+
+    // Ban the peer from being re-dialed for a cooldown period (exponential backoff)
+    const banTimeMs = this.config.peerFailedBanTimeMs ?? DEFAULT_FAILED_PEER_BAN_TIME_MS;
+    const backoffMs = banTimeMs * Math.pow(2, Math.min(failureCount - 1, 5));
+    this.timedOutPeers.set(peerIdStr, {
+      peerId: peerIdStr,
+      timeoutUntilMs: now + backoffMs,
+    });
+    this.cachedPeers.delete(peerIdStr);
   }
 
   /*

package/src/services/peer-manager/peer_scoring.ts

@@ -1,5 +1,6 @@
 import { median } from '@aztec/foundation/collection';
 import { createLogger } from '@aztec/foundation/log';
+import { DateProvider } from '@aztec/foundation/timer';
 import { PeerErrorSeverity } from '@aztec/stdlib/p2p';
 import {
   Attributes,
@@ -54,6 +55,7 @@ export enum PeerScoreState {
 // TODO: move into config / constants
 const MIN_SCORE_BEFORE_BAN = -100;
 const MIN_SCORE_BEFORE_DISCONNECT = -50;
+const SCORE_CLEANUP_THRESHOLD = 0.1;
 
 export class PeerScoring {
   private logger = createLogger('p2p:peer-scoring');
@@ -65,7 +67,11 @@ export class PeerScoring {
 
   private peerStateCounter: UpDownCounter;
 
-  constructor(config: P2PConfig, telemetry: TelemetryClient = getTelemetryClient()) {
+  constructor(
+    config: P2PConfig,
+    telemetry: TelemetryClient = getTelemetryClient(),
+    private readonly dateProvider: DateProvider = new DateProvider(),
+  ) {
     const orderedValues = config.peerPenaltyValues?.sort((a, b) => a - b);
     this.peerPenalties = {
       [PeerErrorSeverity.HighToleranceError]:
@@ -92,7 +98,7 @@ export class PeerScoring {
   }
 
   updateScore(peerId: string, scoreDelta: number): number {
-    const currentTime = Date.now();
+    const currentTime = this.dateProvider.now();
     const lastUpdate = this.lastUpdateTime.get(peerId) || currentTime;
     const timePassed = currentTime - lastUpdate;
     const decayPeriods = Math.floor(timePassed / this.decayInterval);
@@ -111,19 +117,35 @@ export class PeerScoring {
   }
 
   decayAllScores(): void {
-    const currentTime = Date.now();
+    const currentTime = this.dateProvider.now();
     for (const [peerId, lastUpdate] of this.lastUpdateTime.entries()) {
       const timePassed = currentTime - lastUpdate;
       const decayPeriods = Math.floor(timePassed / this.decayInterval);
       if (decayPeriods > 0) {
         let score = this.scores.get(peerId) || 0;
         score *= Math.pow(this.decayFactor, decayPeriods);
-        this.scores.set(peerId, score);
-        this.lastUpdateTime.set(peerId, currentTime);
+        if (Math.abs(score) < SCORE_CLEANUP_THRESHOLD) {
+          this.scores.delete(peerId);
+          this.lastUpdateTime.delete(peerId);
+        } else {
+          this.scores.set(peerId, score);
+          this.lastUpdateTime.set(peerId, currentTime);
+        }
       }
     }
   }
 
+  /** Resets all peer scores. Useful for benchmarks to prevent cross-case contamination. */
+  resetAllScores(): void {
+    this.scores.clear();
+    this.lastUpdateTime.clear();
+  }
+
+  removePeer(peerId: string): void {
+    this.scores.delete(peerId);
+    this.lastUpdateTime.delete(peerId);
+  }
+
   getScore(peerId: string): number {
     return this.scores.get(peerId) || 0;
   }

package/src/services/reqresp/README.md

@@ -46,7 +46,6 @@ Per-protocol size limits checked via preamble before decompression.
 | Error Type | Severity |
 |------------|----------|
 | GOODBYE subprotocol errors | None |
-| `CollectiveReqRespTimeoutError` / `InvalidResponseError` | None |
 | `AbortError` / connection close / muxer closed | None |
 | `ECONNRESET` / `EPIPE` / `ECONNREFUSED` / `ERR_UNEXPECTED_EOF` | HighToleranceError |
 | `ERR_UNSUPPORTED_PROTOCOL` | HighToleranceError |
@@ -183,19 +182,6 @@ Protected peers (private/trusted/preferred) are always considered "authenticated
 
 Conditional registration: BLOCK_TXS handler only registered when `config.disableTransactions` is false. Otherwise peers get `ERR_UNSUPPORTED_PROTOCOL`.
 
-**Requester side via `sendBatchRequest`** (Snappy limit: `max(N, 1) * 512 + 1` KB):
-
-| Rule | Consequence | File |
-|------|-------------|------|
-| Archive root must match request | MidToleranceError | `libp2p_service.ts` (`validateRequestedBlockTxs`) |
-| BitVector length must match request | MidToleranceError | same |
-| No duplicate tx hashes | MidToleranceError | same |
-| Tx count within bounds | MidToleranceError | same |
-| Local block proposal must exist for archive root | Rejected (no penalty) | same |
-| All tx hashes must be in proposal's tx list at allowed indices | LowToleranceError | same |
-| Txs in strictly increasing index order | LowToleranceError | same |
-| Each tx passes well-formedness (Metadata [4 fields], Size, Data, Proof) | LowToleranceError | same |
-
 **Requester side via `BatchTxRequester`** (separate validation path):
 
 | Rule | Consequence | File |

package/src/services/reqresp/batch-tx-requester/batch_tx_requester.ts

@@ -4,9 +4,10 @@ import { FifoMemoryQueue, type ISemaphore, Semaphore } from '@aztec/foundation/q
 import { sleep } from '@aztec/foundation/sleep';
 import { DateProvider } from '@aztec/foundation/timer';
 import { PeerErrorSeverity } from '@aztec/stdlib/p2p';
-import { Tx, TxArray, TxHash } from '@aztec/stdlib/tx';
+import { Tx, TxArray, TxHash, type TxValidator } from '@aztec/stdlib/tx';
 
 import type { PeerId } from '@libp2p/interface';
+import { strict as assert } from 'assert';
 
 import type { IRequestTracker } from '../../tx_collection/request_tracker.js';
 import { ReqRespSubProtocol } from '.././interface.js';
@@ -21,7 +22,7 @@ import {
 import type { BatchTxRequesterLibP2PService, BatchTxRequesterOptions, ITxMetadataCollection } from './interface.js';
 import { MissingTxMetadataCollection } from './missing_txs.js';
 import { type IPeerCollection, PeerCollection } from './peer_collection.js';
-import { BatchRequestTxValidator, type IBatchRequestTxValidator } from './tx_validator.js';
+import { createBatchRequestTxValidator } from './tx_validator.js';
 
 /*
  * Tries to fetch all missing transaction until deadline is hit.
@@ -51,7 +52,7 @@ export class BatchTxRequester {
   private readonly txsMetadata: ITxMetadataCollection;
   private readonly smartRequesterSemaphore: ISemaphore;
   private readonly txQueue: FifoMemoryQueue<Tx>;
-  private readonly txValidator: IBatchRequestTxValidator;
+  private readonly txValidator: TxValidator;
   private readonly smartParallelWorkerCount: number;
   private readonly dumbParallelWorkerCount: number;
   private readonly txBatchSize: number;
@@ -78,7 +79,7 @@ export class BatchTxRequester {
       this.opts.dumbParallelWorkerCount ?? DEFAULT_BATCH_TX_REQUESTER_DUMB_PARALLEL_WORKER_COUNT;
     this.txBatchSize = this.opts.txBatchSize ?? DEFAULT_BATCH_TX_REQUESTER_TX_BATCH_SIZE;
     this.txQueue = new FifoMemoryQueue(this.logger);
-    this.txValidator = this.opts.txValidator ?? new BatchRequestTxValidator(this.p2pService.txValidatorConfig);
+    this.txValidator = this.opts.txValidator ?? createBatchRequestTxValidator(this.p2pService.txValidatorConfig);
 
     if (this.opts.peerCollection) {
       this.peers = this.opts.peerCollection;
@@ -97,7 +98,7 @@ export class BatchTxRequester {
   }
 
   /*
-   * Fetches all missing transactions and yields them  one by one
+   * Fetches all missing transactions and yields them one by one
    * */
   public async *run(): AsyncGenerator<Tx, Tx | undefined, unknown> {
     try {
@@ -428,6 +429,15 @@ export class BatchTxRequester {
       }
 
       const blockResponse = BlockTxsResponse.fromBuffer(response.data);
+
+      // Validate response. Peers will be penalised by the validator if they send invalid response.
+      const isValid = await this.p2pService.validateRequestedBlockTxsConsistency(request, blockResponse, peerId);
+      if (!isValid) {
+        this.logger.debug(`Peer ${peerId.toString()} sent invalid response`);
+        this.handleFailResponseFromPeer(peerId, ReqRespStatus.INTERNAL_ERROR);
+        return;
+      }
+
       await this.handleSuccessResponseFromPeer(peerId, blockResponse);
     } catch (err: any) {
       this.logger.error(`Failed to get valid response from peer ${peerId.toString()}: ${err.message}`, {
@@ -445,27 +455,24 @@ export class BatchTxRequester {
    * Handles failed response form the peer
    * There are 3 scenarios
    * - RATE_LIMIT_EXCEEDED: We mark this and don't query this peer again for some_time
+   * - INTERNAL_ERROR: We use this to cover cases where the request-response consistency validation fails.
    * - FAILURE and UNKNOWN: We penalise this, if peer has been penalised this way N times they are not queried again
    *   this implies we will query these peers couple of more times and give them a chance to "redeem" themselves before completely ignoring them
    */
   private handleFailResponseFromPeer(peerId: PeerId, responseStatus: ReqRespStatus) {
-    if (responseStatus === ReqRespStatus.FAILURE || responseStatus === ReqRespStatus.UNKNOWN) {
-      this.peers.penalisePeer(peerId, PeerErrorSeverity.HighToleranceError);
-      this.peers.markPeerDumb(peerId);
-      this.txsMetadata.clearPeerData(peerId);
-      return;
-    }
-
-    // NOT_FOUND means the peer pruned its block proposal — it can no longer serve
-    // index-based requests, but this is a legitimate state so we don't penalize.
-    if (responseStatus === ReqRespStatus.NOT_FOUND) {
-      this.peers.markPeerDumb(peerId);
-      this.txsMetadata.clearPeerData(peerId);
-      return;
-    }
-
-    if (responseStatus === ReqRespStatus.RATE_LIMIT_EXCEEDED) {
-      this.peers.markPeerRateLimitExceeded(peerId);
+    switch (responseStatus) {
+      case ReqRespStatus.RATE_LIMIT_EXCEEDED:
+        this.peers.markPeerRateLimitExceeded(peerId);
+        return;
+      case ReqRespStatus.INTERNAL_ERROR:
+        this.peers.markPeerDumb(peerId);
+        this.txsMetadata.clearPeerData(peerId);
+        return;
+      default: // includes FAILURE, UNKNOWN
+        this.peers.penalisePeer(peerId, PeerErrorSeverity.HighToleranceError);
+        this.peers.markPeerDumb(peerId);
+        this.txsMetadata.clearPeerData(peerId);
+        return;
     }
   }
 
@@ -485,7 +492,7 @@ export class BatchTxRequester {
    * Handles received txs.
    * Transactions are validated and then put on async queue
    * to be yielded by main running loop
-   * */
+   */
   private async handleReceivedTxs(peerId: PeerId, txs: TxArray) {
     const newTxs = txs.filter(tx => !this.txsMetadata.alreadyFetched(tx.txHash));
 
@@ -493,12 +500,12 @@ export class BatchTxRequester {
       return;
     }
 
-    //TODO: this validation can be slow, maybe spawn worker just for validation
+    // TODO: this validation can be slow, maybe spawn worker just for validation
     // We could use the async queue for communication.
     const validationResults = await Promise.allSettled(
       newTxs.map(async tx => ({
         tx,
-        isValid: (await this.txValidator.validateRequestedTx(tx)).result === 'valid',
+        isValid: (await this.txValidator.validateTx(tx)).result === 'valid',
       })),
     );
 
@@ -514,6 +521,9 @@ export class BatchTxRequester {
     });
 
     if (hasInvalidTx) {
+      this.logger.warn(`Penalizing peer ${peerId.toString()} for sending invalid transactions in batch response`, {
+        peerId,
+      });
       this.peers.penalisePeer(peerId, PeerErrorSeverity.LowToleranceError);
     } else {
       // If we have received successful response from the peer, they have "redeemed" themselves and not considered bad anymore
@@ -550,9 +560,10 @@ export class BatchTxRequester {
       return;
     }
 
-    const hasArchiveRootMismatch = this.blockTxsSource.archive.toString() !== response.archiveRoot.toString();
-    if (hasArchiveRootMismatch) {
-      this.handleArchiveRootMismatch(peerId, response);
+    // If the peer doesn't have the block, we mark them as dumb.
+    if (!response.peerHasBlock()) {
+      this.peers.markPeerDumb(peerId);
+      this.txsMetadata.clearPeerData(peerId);
       return;
     }
 
@@ -570,21 +581,6 @@ export class BatchTxRequester {
     this.smartRequesterSemaphore.release();
   }
 
-  /**
-   * Handles an archive root mismatch between local state and peer response.
-   *
-   * - Response archive is Fr.ZERO (peer pruned proposal, legitimate): marks peer dumb.
-   * - Non-zero archive mismatch (malicious response): penalises + marks dumb.
-   */
-  private handleArchiveRootMismatch(peerId: PeerId, response: BlockTxsResponse): void {
-    if (!response.archiveRoot.isZero()) {
-      this.peers.penalisePeer(peerId, PeerErrorSeverity.LowToleranceError);
-    }
-
-    this.peers.markPeerDumb(peerId);
-    this.txsMetadata.clearPeerData(peerId);
-  }
-
   private peerHasSomeTxsWeAreMissing(_peerId: PeerId, response: BlockTxsResponse): boolean {
     if (response.txIndices.isEmpty()) {
       return false;
@@ -600,15 +596,9 @@ export class BatchTxRequester {
   }
 
   private extractHashesPeerHasFromResponse(response: BlockTxsResponse): Array<TxHash> {
-    const hashes: TxHash[] = [];
-    const indicesOfHashesPeerHas = new Set(response.txIndices.getTrueIndices());
-    this.blockTxsSource.txHashes.forEach((hash, idx) => {
-      if (indicesOfHashesPeerHas.has(idx)) {
-        hashes.push(hash);
-      }
-    });
-
-    return hashes;
+    // Should already have been validated, but just in case.
+    assert(response.txIndices.getLength() === this.blockTxsSource.txHashes.length);
+    return response.txIndices.getTrueIndices().map(idx => this.blockTxsSource.txHashes[idx]);
   }
 
   /*

package/src/services/reqresp/batch-tx-requester/interface.ts

@@ -1,13 +1,14 @@
 import type { ISemaphore } from '@aztec/foundation/queue';
 import type { PeerErrorSeverity } from '@aztec/stdlib/p2p';
-import type { Tx, TxHash } from '@aztec/stdlib/tx';
+import type { Tx, TxHash, TxValidator } from '@aztec/stdlib/tx';
 
 import type { PeerId } from '@libp2p/interface';
 
 import type { ConnectionSampler } from '../connection-sampler/connection_sampler.js';
+import type { BlockTxsRequest, BlockTxsResponse } from '../index.js';
 import type { ReqRespInterface } from '../interface.js';
 import type { IPeerCollection } from './peer_collection.js';
-import type { BatchRequestTxValidatorConfig, IBatchRequestTxValidator } from './tx_validator.js';
+import type { BatchRequestTxValidatorConfig } from './tx_validator.js';
 
 export interface IPeerPenalizer {
   penalizePeer(peerId: PeerId, penalty: PeerErrorSeverity): void;
@@ -32,13 +33,19 @@ export interface ITxMetadataCollection {
  */
 export interface BatchTxRequesterLibP2PService {
   /** ReqResp interface for sending requests to peers */
-  reqResp: Pick<ReqRespInterface, 'sendBatchRequest' | 'sendRequestToPeer'>;
+  reqResp: Pick<ReqRespInterface, 'sendRequestToPeer'>;
   /** Connection sampler for getting peer lists */
   connectionSampler: Pick<ConnectionSampler, 'getPeerListSortedByConnectionCountAsc'>;
   /** Configuration needed for transaction validation */
   txValidatorConfig: BatchRequestTxValidatorConfig;
   /** Peer scoring for penalizing peers */
   peerScoring: IPeerPenalizer;
+  /** Validate the requested block transactions request-response consistency */
+  validateRequestedBlockTxsConsistency: (
+    request: BlockTxsRequest,
+    response: BlockTxsResponse,
+    peerId: PeerId,
+  ) => Promise<boolean>;
 }
 
 export interface BatchTxRequesterOptions {
@@ -50,5 +57,5 @@ export interface BatchTxRequesterOptions {
   semaphore?: ISemaphore;
   peerCollection?: IPeerCollection;
   /** Optional tx validator for testing - if not provided, one is created from p2pService.txValidatorConfig */
-  txValidator?: IBatchRequestTxValidator;
+  txValidator?: TxValidator;
 }

package/src/services/reqresp/batch-tx-requester/tx_validator.ts

@@ -1,37 +1,24 @@
 import type { ClientProtocolCircuitVerifier } from '@aztec/stdlib/interfaces/server';
-import { Tx, type TxValidationResult, type TxValidator } from '@aztec/stdlib/tx';
+import type { TxValidator } from '@aztec/stdlib/tx';
 
-import { createTxValidatorForReqResponseReceivedTxs } from '../../../msg_validators/index.js';
+import { createTxValidatorForOnDemandReceivedTxs } from '../../../msg_validators/index.js';
+import type { TxValidationCache } from '../../../msg_validators/tx_validator/tx_validation_cache.js';
 
 export interface BatchRequestTxValidatorConfig {
   l1ChainId: number;
   rollupVersion: number;
   proofVerifier: ClientProtocolCircuitVerifier;
+  txValidationCache?: TxValidationCache;
 }
 
-export interface IBatchRequestTxValidator {
-  validateRequestedTx(tx: Tx): Promise<TxValidationResult>;
-  validateRequestedTxs(txs: Tx[]): Promise<TxValidationResult[]>;
-}
-
-export class BatchRequestTxValidator implements IBatchRequestTxValidator {
-  readonly txValidator: TxValidator;
-  constructor(private readonly config: BatchRequestTxValidatorConfig) {
-    this.txValidator = BatchRequestTxValidator.createRequestedTxValidator(this.config);
-  }
-
-  public async validateRequestedTx(tx: Tx): Promise<TxValidationResult> {
-    return await this.txValidator.validateTx(tx);
-  }
-
-  public async validateRequestedTxs(txs: Tx[]): Promise<TxValidationResult[]> {
-    return await Promise.all(txs.map(tx => this.validateRequestedTx(tx)));
-  }
-
-  static createRequestedTxValidator(config: BatchRequestTxValidatorConfig): TxValidator {
-    return createTxValidatorForReqResponseReceivedTxs(config.proofVerifier, {
+export function createBatchRequestTxValidator(config: BatchRequestTxValidatorConfig): TxValidator {
+  return createTxValidatorForOnDemandReceivedTxs(
+    config.proofVerifier,
+    {
       l1ChainId: config.l1ChainId,
       rollupVersion: config.rollupVersion,
-    });
-  }
+    },
+    /*bindings=*/ undefined,
+    config.txValidationCache,
+  );
 }

package/src/services/reqresp/config.ts

@@ -1,4 +1,4 @@
-import { type ConfigMapping, booleanConfigHelper, numberConfigHelper } from '@aztec/foundation/config';
+import { type ConfigMappingsType, booleanConfigHelper, numberConfigHelper } from '@aztec/foundation/config';
 
 export const DEFAULT_INDIVIDUAL_REQUEST_TIMEOUT_MS = 10_000;
 export const DEFAULT_OVERALL_REQUEST_TIMEOUT_MS = 10_000; // Not currently used
@@ -27,7 +27,7 @@ export interface P2PReqRespConfig {
   dialTimeoutMs: number;
 }
 
-export const p2pReqRespConfigMappings: Record<keyof P2PReqRespConfig, ConfigMapping> = {
+export const p2pReqRespConfigMappings: ConfigMappingsType<P2PReqRespConfig> = {
   overallRequestTimeoutMs: {
     env: 'P2P_REQRESP_OVERALL_REQUEST_TIMEOUT_MS',
     description: 'The overall timeout for a request response operation.',

package/src/services/reqresp/interface.ts

@@ -1,6 +1,3 @@
-import { Fr } from '@aztec/foundation/curves/bn254';
-import { L2Block } from '@aztec/stdlib/block';
-import { MAX_L2_BLOCK_SIZE_KB } from '@aztec/stdlib/p2p';
 import { TxArray, TxHashArray } from '@aztec/stdlib/tx';
 
 import type { PeerId } from '@libp2p/interface';
@@ -24,7 +21,6 @@ export const PING_PROTOCOL = '/aztec/req/ping/1.0.0';
 export const STATUS_PROTOCOL = '/aztec/req/status/1.0.0';
 export const GOODBYE_PROTOCOL = '/aztec/req/goodbye/1.0.0';
 export const TX_REQ_PROTOCOL = '/aztec/req/tx/1.0.0';
-export const BLOCK_REQ_PROTOCOL = '/aztec/req/block/1.0.0';
 export const AUTH_PROTOCOL = '/aztec/req/auth/1.0.0';
 export const BLOCK_TXS_REQ_PROTOCOL = '/aztec/req/block_txs/1.0.0';
 
@@ -33,7 +29,6 @@ export enum ReqRespSubProtocol {
   STATUS = STATUS_PROTOCOL,
   GOODBYE = GOODBYE_PROTOCOL,
   TX = TX_REQ_PROTOCOL,
-  BLOCK = BLOCK_REQ_PROTOCOL,
   AUTH = AUTH_PROTOCOL,
   BLOCK_TXS = BLOCK_TXS_REQ_PROTOCOL,
 }
@@ -83,32 +78,28 @@ export interface ProtocolRateLimitQuota {
   globalLimit: RateLimitQuota;
 }
 
-export const noopValidator = () => Promise.resolve(true);
-
 /**
  * A type mapping from supprotocol to it's handling function
  */
 export type ReqRespSubProtocolHandlers = Record<ReqRespSubProtocol, ReqRespSubProtocolHandler>;
 
-type ResponseValidator<RequestIdentifier, Response> = (
-  request: RequestIdentifier,
-  response: Response,
-  peerId: PeerId,
-) => Promise<boolean>;
-
-export type ReqRespSubProtocolValidators = {
-  [S in ReqRespSubProtocol]: ResponseValidator<any, any>;
-};
+/**
+ * Protocols that are always allowed without authentication, even when p2pAllowOnlyValidators is enabled.
+ * These are needed for the handshake and connection management flow.
+ * All other protocols require the remote peer to be authenticated.
+ */
+export const UNAUTHENTICATED_ALLOWED_PROTOCOLS: ReadonlySet<ReqRespSubProtocol> = new Set([
+  ReqRespSubProtocol.PING,
+  ReqRespSubProtocol.STATUS,
+  ReqRespSubProtocol.AUTH,
+  ReqRespSubProtocol.GOODBYE,
+]);
 
-export const DEFAULT_SUB_PROTOCOL_VALIDATORS: ReqRespSubProtocolValidators = {
-  [ReqRespSubProtocol.PING]: noopValidator,
-  [ReqRespSubProtocol.STATUS]: noopValidator,
-  [ReqRespSubProtocol.TX]: noopValidator,
-  [ReqRespSubProtocol.GOODBYE]: noopValidator,
-  [ReqRespSubProtocol.BLOCK]: noopValidator,
-  [ReqRespSubProtocol.AUTH]: noopValidator,
-  [ReqRespSubProtocol.BLOCK_TXS]: noopValidator,
-};
+/**
+ * Callback that checks whether a peer should be rejected from req/resp data protocols.
+ * Returns true if the peer should be rejected (i.e. p2pAllowOnlyValidators is on and peer is unauthenticated).
+ */
+export type ShouldRejectPeer = (peerId: string) => boolean;
 
 /*
  * Helper class to sub-protocol validation error*/
@@ -203,10 +194,6 @@ export const subProtocolMap = {
     request: RequestableBuffer,
     response: RequestableBuffer,
   },
-  [ReqRespSubProtocol.BLOCK]: {
-    request: Fr, // block number
-    response: L2Block,
-  },
   [ReqRespSubProtocol.AUTH]: {
     request: AuthRequest,
     response: AuthResponse,
@@ -229,7 +216,6 @@ export type ExpectedResponseSizeCalculator = (requestBuffer: Buffer) => number;
 export const subProtocolSizeCalculators: Record<ReqRespSubProtocol, ExpectedResponseSizeCalculator> = {
   [ReqRespSubProtocol.TX]: calculateTxResponseSize,
   [ReqRespSubProtocol.BLOCK_TXS]: calculateBlockTxsResponseSize,
-  [ReqRespSubProtocol.BLOCK]: () => MAX_L2_BLOCK_SIZE_KB,
   [ReqRespSubProtocol.STATUS]: () => 1,
   [ReqRespSubProtocol.PING]: () => 1,
   [ReqRespSubProtocol.AUTH]: () => 1,
@@ -237,24 +223,9 @@ export const subProtocolSizeCalculators: Record<ReqRespSubProtocol, ExpectedResp
 };
 
 export interface ReqRespInterface {
-  start(
-    subProtocolHandlers: Partial<ReqRespSubProtocolHandlers>,
-    subProtocolValidators: ReqRespSubProtocolValidators,
-  ): Promise<void>;
-  addSubProtocol(
-    subProtocol: ReqRespSubProtocol,
-    handler: ReqRespSubProtocolHandler,
-    validator?: ReqRespSubProtocolValidators[ReqRespSubProtocol],
-  ): Promise<void>;
+  start(subProtocolHandlers: Partial<ReqRespSubProtocolHandlers>): Promise<void>;
+  addSubProtocol(subProtocol: ReqRespSubProtocol, handler: ReqRespSubProtocolHandler): Promise<void>;
   stop(): Promise<void>;
-  sendBatchRequest<SubProtocol extends ReqRespSubProtocol>(
-    subProtocol: SubProtocol,
-    requests: InstanceType<SubProtocolMap[SubProtocol]['request']>[],
-    pinnedPeer: PeerId | undefined,
-    timeoutMs?: number,
-    maxPeers?: number,
-    maxRetryAttempts?: number,
-  ): Promise<InstanceType<SubProtocolMap[SubProtocol]['response']>[]>;
   sendRequestToPeer(
     peerId: PeerId,
     subProtocol: ReqRespSubProtocol,
@@ -264,5 +235,8 @@ export interface ReqRespInterface {
 
   updateConfig(config: Partial<P2PReqRespConfig>): void;
 
+  /** Sets the callback used to reject unauthenticated peers on gated req/resp protocols. */
+  setShouldRejectPeer(checker: ShouldRejectPeer): void;
+
   getConnectionSampler(): Pick<ConnectionSampler, 'getPeerListSortedByConnectionCountAsc'>;
 }

package/src/services/reqresp/metrics.ts

@@ -26,7 +26,6 @@ export class ReqRespMetrics {
         ReqRespSubProtocol.STATUS,
         ReqRespSubProtocol.GOODBYE,
         ReqRespSubProtocol.TX,
-        ReqRespSubProtocol.BLOCK,
         ReqRespSubProtocol.AUTH,
         ReqRespSubProtocol.BLOCK_TXS,
       ],

package/src/services/reqresp/protocols/block_txs/bitvector.ts

@@ -58,8 +58,9 @@ export class BitVector {
   }
 
   /**
-   * Returns all indices which are set to true
-   * */
+   * Returns all indices which are set to true.
+   * Ordered by index. No duplicates.
+   */
   getTrueIndices(): number[] {
     return Array.from({ length: this.length }, (_, i) => i).filter(i => this.isSet(i));
   }