net: cap inbound connections per address

A single IP could hold every inbound slot up to MAX_CONNECTIONS -- which
is what a connection-exhaustion flood did to the rendezvous relays, one
address parking hundreds of sockets and starving real peers. Add
MAX_CONNECTIONS_PER_IP (32): the accept path counts existing connections
from the same address and refuses a new one past the cap. The relays'
firewall connlimit does the same a layer lower; this makes every build
carry the defense, including future poll()-based relays with no FD ceiling.

2 files changed, 26 insertions, 0 deletions

diff --git a/src/net.cpp b/src/net.cpp
index 3660735..6e74cbb 100644
--- a/src/net.cpp
+++ b/src/net.cpp
@@ -1622,12 +1622,29 @@ void ThreadSocketHandler2(void* parg)
                 unsigned int nNodes = 0;
                 CRITICAL_BLOCK(cs_vNodes)
                     nNodes = (unsigned int)vNodes.size();
+                // Also count how many connections this one address already
+                // holds. A single IP that keeps opening sockets -- a broken
+                // node or a deliberate connection-exhaustion flood -- must not
+                // be able to take the whole table, which is what starved the
+                // relays.
+                unsigned int nFromThisIP = 0;
+                CRITICAL_BLOCK(cs_vNodes)
+                    for (vector<CNode*>::iterator it = vNodes.begin(); it != vNodes.end(); ++it)
+                        if ((*it)->addr.ip == addr.ip)
+                            nFromThisIP++;
+
                 if (nNodes >= MAX_CONNECTIONS)
                 {
                     LogPrint("net", "refusing connection from %s, already at %u\n",
                              addr.ToString().c_str(), nNodes);
                     BtfCloseSocket(hSocket);
                 }
+                else if (nFromThisIP >= MAX_CONNECTIONS_PER_IP)
+                {
+                    LogPrint("net", "refusing connection from %s, already %u from that address\n",
+                             addr.ToString().c_str(), nFromThisIP);
+                    BtfCloseSocket(hSocket);
+                }
                 else
                 {
                     LogPrint("net", "accepted connection from %s\n", addr.ToString().c_str());
diff --git a/src/net.h b/src/net.h
index 984588b..4fdd1b3 100644
--- a/src/net.h
+++ b/src/net.h
@@ -112,6 +112,15 @@ static const int          BTF_INCOMPLETE_MESSAGE_TIMEOUT_SECS = 2 * 60;
 // 125 is Bitcoin's number and remains a conservative public-node default.
 static const unsigned int MAX_CONNECTIONS = 125;
 
+// Cap inbound connections from any single address. Without it one source can
+// hold every slot up to MAX_CONNECTIONS -- exactly what happened to the
+// rendezvous relays, where a single IP parked hundreds of connections and
+// starved real peers. A legitimate peer, even a relay talking to a relay,
+// needs only a handful; 32 leaves generous room while denying any one address
+// more than a quarter of the table. The firewall connlimit on the relays does
+// the same thing a layer lower; this makes every build carry the defense.
+static const unsigned int MAX_CONNECTIONS_PER_IP = 32;
+
 // A node marked for disconnect is normally held until its buffers drain, so
 // a last message still goes out. But vSend cannot drain through a socket
 // whose far end is gone, and that made such a node immortal: it stayed in