fix(p2p): bound the inbound node-info exchange by the handshake deadline

[bdchatham]

Problem

Router.acceptPeersRoutine holds an accept-semaphore slot from before AcceptOrClose until after the peer's node info is exchanged. handshakeCtx carries handshake-timeout and covers handshake(), but the next line takes the connection context:

hConn, err := handshake(handshakeCtx, tcpConn, ...)   // bounded
info, err := exchangeNodeInfo(ctx, hConn, ...)        // unbounded
release()

exchangeNodeInfo blocks on conn.ReadSizedMsg, which has no deadline of its own and reads the length varint a byte at a time. The node info exchange is part of the handshake, so it should run under the same deadline; as written, a peer that goes quiet part way through holds its slot for as long as its socket survives.

What that guards is a peer losing connectivity mid-exchange, not a malicious one. A peer that completes the exchange releases the accept slot and moves into the inbound peer budget, where it can hold a connection open by answering pings while sending nothing useful, so this bound does not stop anyone determined.

Change

-  info, err := exchangeNodeInfo(ctx, hConn, *r.nodeInfoProducer())
+  info, err := exchangeNodeInfo(handshakeCtx, hConn, *r.nodeInfoProducer())

handshakeCtx already exists and already covers the handshake. This extends it over the rest of the region where the slot is held.

context.WithTimeout is an absolute deadline rather than an idle one, so a peer that drips bytes slowly is still cut off at handshake-timeout. Teardown was already correct: on cancellation tcp.Conn.Read calls CloseRead() and waits for the read pump to return data ownership, so the aborted read leaks neither a goroutine nor a half-open socket.

The default stays at 10s. Bounding the read is the fix; tuning the deadline down is a separate judgement about slow links.

Notes for review

• No new test, and that is the gap I would most like a second opinion on. Pinning this needs a router built directly rather than through MakeTestNetwork: dial its endpoint with tcp.Dial, run handshake client-side to completion, send no node info, and assert the connection closes within the deadline. Happy to add it here if you would rather not merge without it.
• No lock is held across the affected read. Advertise() and nodeInfoProducer() both complete before the I/O begins, and connTracker.AddConn's critical section is map operations only, so the slot is the only resource involved.
• go build ./..., go test ./internal/p2p/, gofmt, goimports and golangci-lint (v2.8.0) are clean.

[cursor]

PR Summary

Low Risk
Narrow inbound accept-path context change aligned with existing outbound handshake timeout behavior; low risk to established peers that complete node-info promptly.

Overview
Inbound peers could keep an accept-semaphore slot after crypto handshake if they stalled during node-info exchange, because that step used the long-lived connection ctx while only handshake() ran under handshakeCtx.

acceptPeersRoutine now passes handshakeCtx into exchangeNodeInfo, so the same HandshakeTimeout caps the full pre-runConn handshake phase and the slot is released when the deadline fires.

Adds TestRouter_InboundNodeInfoBoundedByHandshakeDeadline: dial the router, finish handshake without sending node info, and expect the router to close the connection (EOF) within a short test timeout.

^{Reviewed by Cursor Bugbot for commit 4338572. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Aug 13, 2026, 3:23 PM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.47%. Comparing base (8bbac80) to head (4338572).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3916      +/-   ##
==========================================
- Coverage   59.48%   58.47%   -1.01%     
==========================================
  Files        2325     2229      -96     
  Lines      198647   188004   -10643     
==========================================
- Hits       118160   109936    -8224     
+ Misses      69258    67682    -1576     
+ Partials    11229    10386     -843     

Flag	Coverage Δ
sei-chain-pr	77.85% <100.00%> (?)
sei-db	70.41% <ø> (ø)
sei-db-state-db	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
sei-tendermint/internal/p2p/router.go	90.65% <100.00%> (ø)

... and 137 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[seidroid]

One-line fix that bounds the inbound exchangeNodeInfo read by handshakeCtx, closing a slot-exhaustion vector where a peer could hold an accept-semaphore slot indefinitely; the change is correct and makes the accept path symmetric with the dial path, which already covers both handshake and node-info exchange under the same timeout. The only gap is the absence of a regression test, which the author already called out.

Findings: 0 blocking | 1 non-blocking | 0 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• No regression test covers the fix: a peer that completes the handshake and then stops sending node info should have its connection torn down and its accept-semaphore slot released once HandshakeTimeout expires. The existing router test sets HandshakeTimeout: utils.Some(time.Hour) (sei-tendermint/internal/p2p/router_test.go:283), so nothing exercises expiry and this one-line change could silently regress. The test sketch in the PR description (build the router directly, dial with tcp.Dial, run handshake client-side, send no node info, assert the connection closes within the deadline) looks like the right shape.