fix: limit signing share sessions per peer

Author: thepastaclaw

src/Makefile.test.include

@@ -136,6 +136,7 @@ BITCOIN_TESTS =\
   test/llmq_commitment_tests.cpp \
   test/llmq_hash_tests.cpp \
   test/llmq_params_tests.cpp \
+  test/llmq_signing_shares_tests.cpp \
   test/llmq_snapshot_tests.cpp \
   test/llmq_utils_tests.cpp \
   test/logging_tests.cpp \

src/llmq/signing_shares.cpp

@@ -22,10 +22,21 @@
 
 #include <cxxtimer.hpp>
 
+#include <algorithm>
 #include <ranges>
 
 namespace llmq
 {
+namespace {
+constexpr size_t MAX_SESSIONS_PER_PEER_FACTOR{4};
+constexpr size_t MIN_SESSIONS_PER_PEER{100};
+
+size_t GetMaxSessionsForPeer(const Consensus::LLMQParams& params)
+{
+    return std::max<size_t>(size_t(params.size) * MAX_SESSIONS_PER_PEER_FACTOR, MIN_SESSIONS_PER_PEER);
+}
+} // namespace
+
 void CSigShare::UpdateKey()
 {
     key.first = this->buildSignHash().Get();
@@ -133,6 +144,16 @@ CSigSharesNodeState::Session& CSigSharesNodeState::GetOrCreateSessionFromAnn(con
     return s;
 }
 
+bool CSigSharesNodeState::CanCreateSessionFromAnn(const llmq::CSigSesAnn& ann, size_t maxSessions) const
+{
+    return sessions.count(ann.buildSignHash().Get()) != 0 || sessions.size() < maxSessions;
+}
+
+size_t CSigSharesNodeState::GetSessionCount() const
+{
+    return sessions.size();
+}
+
 CSigSharesNodeState::Session* CSigSharesNodeState::GetSessionBySignHash(const uint256& signHash)
 {
     auto it = sessions.find(signHash);
@@ -206,7 +227,8 @@ void CSigSharesManager::UnregisterRecoveryInterface()
 bool CSigSharesManager::ProcessMessageSigSesAnn(const CNode& pfrom, const CSigSesAnn& ann)
 {
     auto llmqType = ann.getLlmqType();
-    if (!Params().GetLLMQ(llmqType).has_value()) {
+    const auto& llmq_params_opt = Params().GetLLMQ(llmqType);
+    if (!llmq_params_opt.has_value()) {
         return false;
     }
     if (ann.getSessionId() == UNINITIALIZED_SESSION_ID || ann.getQuorumHash().IsNull() || ann.getId().IsNull() || ann.getMsgHash().IsNull()) {
@@ -225,7 +247,14 @@ bool CSigSharesManager::ProcessMessageSigSesAnn(const CNode& pfrom, const CSigSe
 
     LOCK(cs);
     auto& nodeState = nodeStates[pfrom.GetId()];
+    const size_t maxSessions = GetMaxSessionsForPeer(*llmq_params_opt);
+    if (!nodeState.CanCreateSessionFromAnn(ann, maxSessions)) {
+        LogPrint(BCLog::LLMQ_SIGS, "CSigSharesManager::%s -- too many sessions. cnt=%d, max=%d, node=%d\n",
+                 __func__, nodeState.GetSessionCount(), maxSessions, pfrom.GetId());
+        return false;
+    }
     auto& session = nodeState.GetOrCreateSessionFromAnn(ann);
+    timeSeenForSessions.try_emplace(ann.buildSignHash().Get(), GetTime<std::chrono::seconds>().count());
     nodeState.sessionByRecvId.erase(session.recvSessionId);
     nodeState.sessionByRecvId.erase(ann.getSessionId());
     session.recvSessionId = ann.getSessionId();
@@ -1247,6 +1276,11 @@ void CSigSharesManager::Cleanup()
                 doneSessions.emplace(sigShare.GetSignHash());
             }
         });
+        for (const auto& [signHash, _] : timeSeenForSessions) {
+            if (doneSessions.count(signHash) == 0 && sigman.HasRecoveredSigForSession(signHash)) {
+                doneSessions.emplace(signHash);
+            }
+        }
         for (const auto& signHash : doneSessions) {
             RemoveSigSharesForSession(signHash);
         }

src/llmq/signing_shares.h

@@ -327,7 +327,6 @@ class CSigSharesNodeState
         CSigSharesInv requested;
         CSigSharesInv knows;
     };
-    // TODO limit number of sessions per node
     Uint256HashMap<Session> sessions;
 
     std::unordered_map<uint32_t, Session*> sessionByRecvId;
@@ -339,6 +338,8 @@ class CSigSharesNodeState
 
     Session& GetOrCreateSessionFromShare(const CSigShare& sigShare);
     Session& GetOrCreateSessionFromAnn(const CSigSesAnn& ann);
+    [[nodiscard]] bool CanCreateSessionFromAnn(const CSigSesAnn& ann, size_t maxSessions) const;
+    [[nodiscard]] size_t GetSessionCount() const;
     Session* GetSessionBySignHash(const uint256& signHash);
     Session* GetSessionByRecvId(uint32_t sessionId);
     bool GetSessionInfoByRecvId(uint32_t sessionId, SessionInfo& retInfo);

src/test/llmq_signing_shares_tests.cpp

@@ -0,0 +1,48 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <test/util/llmq_tests.h>
+#include <test/util/setup_common.h>
+
+#include <consensus/params.h>
+#include <llmq/signing_shares.h>
+
+#include <boost/test/unit_test.hpp>
+
+using namespace llmq;
+using namespace llmq::testutils;
+
+BOOST_FIXTURE_TEST_SUITE(llmq_signing_shares_tests, BasicTestingSetup)
+
+static CSigSesAnn MakeAnn(uint32_t session_id, uint32_t nonce)
+{
+    return CSigSesAnn{session_id, Consensus::LLMQType::LLMQ_50_60, GetTestQuorumHash(1), GetTestQuorumHash(2), GetTestQuorumHash(nonce)};
+}
+
+BOOST_AUTO_TEST_CASE(sig_ses_ann_respects_session_limit_but_allows_refresh)
+{
+    CSigSharesNodeState node_state;
+
+    const CSigSesAnn ann1{MakeAnn(1, 1)};
+    const CSigSesAnn ann2{MakeAnn(2, 2)};
+    const CSigSesAnn ann3{MakeAnn(3, 3)};
+    constexpr size_t max_sessions{2};
+
+    BOOST_CHECK(node_state.CanCreateSessionFromAnn(ann1, max_sessions));
+    node_state.GetOrCreateSessionFromAnn(ann1);
+    BOOST_CHECK_EQUAL(node_state.GetSessionCount(), 1U);
+
+    BOOST_CHECK(node_state.CanCreateSessionFromAnn(ann2, max_sessions));
+    node_state.GetOrCreateSessionFromAnn(ann2);
+    BOOST_CHECK_EQUAL(node_state.GetSessionCount(), max_sessions);
+
+    BOOST_CHECK(!node_state.CanCreateSessionFromAnn(ann3, max_sessions));
+
+    const CSigSesAnn ann1_refresh{4, Consensus::LLMQType::LLMQ_50_60, ann1.getQuorumHash(), ann1.getId(), ann1.getMsgHash()};
+    BOOST_CHECK(node_state.CanCreateSessionFromAnn(ann1_refresh, max_sessions));
+    node_state.GetOrCreateSessionFromAnn(ann1_refresh);
+    BOOST_CHECK_EQUAL(node_state.GetSessionCount(), max_sessions);
+}
+
+BOOST_AUTO_TEST_SUITE_END()