Defend your endorsement nodes: Token-bucket rate limiting for Fabric.

Preventing overload on endorsement nodes is crucial for maintaining the performance of Hyperledger Fabric clusters. One method for doing this is through token-bucket rate limiting, which is the focus of the wFabricSecurity project. ECDSA signature verification is a resource-intensive operation, and flooding an endorsement node with thousands of signature requests can cause it to become overwhelmed, leading to cryptographic CPU exhaustion and legitimate transactions being dropped due to peer resource starvation.

To address these issues, wFabricSecurity provides a token-bucket rate limiter. The limiter is configured to allow a maximum of 100 tokens, with 10 tokens refilled each second. Each participant is assigned a unique Common Name (CN) or IP address, and distinct limits are enforced for each. If the limiter's consume method is unable to grant a token for a particular participant, a RateLimitError is raised, preventing the expensive ECDSA verification process from being triggered.

This architecture offers several advantages. The token-bucket algorithm smoothly handles bursts of traffic while still enforcing sustained rate caps. By applying distinct limits per participant, the system can prevent a single rogue or looping worker from overwhelming the endorsement node. The RateLimitError mechanism traps abusive request spikes before they can cause damage. The implementation is compatible with Python 3.10 and above, and includes cryptographic identity management and code integrity hashing.

For more information, visit the project's GitHub repository at https://github.com/wisrovi/wFabricSecurity or install the package via PyPI at https://pypi.org/project/wFabricSecurity.