fix(llmq): purge pending recovered sigs in BanNode

Widen BanNode to drop CSigningManager::pendingRecoveredSigs for the banned node, and route the two raw recsig PeerMisbehaving(100) sites (invalid QSIGREC llmqType, bad BLS batch source) through BanNode so every NetSigning score-100 path purges eagerly like shares already do via MarkAsBanned.

Remove the 5s PeerIsBanned pending-recsig sweep entirely: that predicate was a ~100ms one-shot and never reliably ran. Queue reclaim for banned peers is now eager on BanNode. Caps from #7402 remain the bound for peers that disconnect without misbehavior. Keep m_sig_manager.Cleanup() for DB age.

Author: PastaPastaPasta

src/llmq/net_signing.cpp

@@ -54,7 +54,7 @@ void NetSigning::ProcessMessage(CNode& pfrom, const std::string& msg_type, CData
                                                                                       recoveredSig->GetHash()}));
 
         if (!Params().GetLLMQ(recoveredSig->getLlmqType()).has_value()) {
-            m_peer_manager->PeerMisbehaving(pfrom.GetId(), 100);
+            BanNode(pfrom.GetId());
             return;
         }
 
@@ -264,7 +264,7 @@ bool NetSigning::ProcessPendingRecoveredSigs()
     for (const auto& [nodeId, v] : recSigsByNode) {
         if (batchVerifier.badSources.count(nodeId)) {
             LogPrint(BCLog::LLMQ, "NetSigning::%s -- invalid recSig from other node, banning peer=%d\n", __func__, nodeId);
-            m_peer_manager->PeerMisbehaving(nodeId, 100);
+            BanNode(nodeId);
             continue;
         }
 
@@ -288,10 +288,6 @@ void NetSigning::WorkThreadSigning()
         constexpr auto CLEANUP_INTERVAL{5s};
         if (cleanupThrottler.TryCleanup(CLEANUP_INTERVAL)) {
             m_sig_manager.Cleanup();
-            // Drop pending recovered sigs queued by banned peers so a flood's backlog does not
-            // persist after the peer is banned (RemoveBannedNodeStates only cleans the sig-shares
-            // subsystem, not m_sig_manager's pending recovered sigs).
-            m_sig_manager.RemoveNodesIf([this](NodeId node_id) { return m_peer_manager->PeerIsBanned(node_id); });
         }
 
         // TODO Wakeup when pending signing is needed?
@@ -313,6 +309,9 @@ void NetSigning::BanNode(NodeId nodeId)
     if (nodeId == -1) return;
 
     m_peer_manager->PeerMisbehaving(nodeId, 100);
+    // Drop any not-yet-verified recovered sigs still queued for this peer so a flood's backlog
+    // does not keep burning the single recsig worker after we have already decided to ban.
+    m_sig_manager.RemoveNodesIf([nodeId](NodeId id) { return id == nodeId; });
     if (m_shares_manager) {
         m_shares_manager->MarkAsBanned(nodeId);
     }

src/llmq/signing.h

@@ -217,8 +217,8 @@ class CSigningManager
         size_t maxUniqueSessions, std::unordered_map<NodeId, std::list<std::shared_ptr<const CRecoveredSig>>>& retSigShares,
         std::unordered_map<std::pair<Consensus::LLMQType, uint256>, CBLSPublicKey, StaticSaltedHasher>& ret_pubkeys)
         EXCLUSIVE_LOCKS_REQUIRED(!cs_pending);
-    // Drop the pending (not-yet-verified) recovered sigs of any node matching the predicate, e.g.
-    // banned peers. Without this, a flooded peer's backlog would persist even after it is banned.
+    // Drop pending (not-yet-verified) recovered sigs for matching node ids (used by BanNode).
+    // Does not touch pendingReconstructedRecoveredSigs (local, node id -1).
     void RemoveNodesIf(const std::function<bool(NodeId)>& predicate) EXCLUSIVE_LOCKS_REQUIRED(!cs_pending);
     [[nodiscard]] std::vector<CRecoveredSigsListener*> GetListeners() const EXCLUSIVE_LOCKS_REQUIRED(!cs_listeners);
     // Returns true if recovered sigs should be send to listeners