Limited number of connections per IP

[xgreenx]

It is possible to create many connections from the same subnetwork and occupy connection slots. This change should limit the number of connections allowed from the same remote IP.

Checklist

• Breaking changes are clearly marked as such in the PR description and changelog
• New behavior is reflected in tests

Before requesting review

• I have reviewed the code myself

[matt-user]

Suggested change

	#[clap(long = "max-peers-per-remote-ip", default_value = "5", env)]
	#[clap(long = "max-peers-per-remote-ip", default_value = "50", env)]

right?

[xgreenx]

No, 5=)

[AurelienFT]

Suggested change

	max_peers_per_remote_ip: 50,
	max_peers_per_remote_ip: 5,

The config default here doesn't match the default on clap

[AurelienFT]

Is it possible that get_ip_addr could return two different IP for an IPv4 and his IPv6 mapped or libp2p prevents IPv4-mapped in IPv6 ?

If it's the first case then they will fall in two separate entries and in this case we might want get_ip_addr to canonicalise the IP (https://doc.rust-lang.org/std/net/enum.IpAddr.html#method.to_canonical)

[AurelienFT]

It seem that this is currently used only to track a number of connection per ip. If we don't want this to be usable for others use cases in the future we could use
HashMap<IpAddr, usize>

It will simplify the current usage that we have by avoiding having to do .len() to measure it.

[Dentosal]

Suggested change

	let entry = self.ips_to_peers.entry(ip);
	match entry {
	Entry::Occupied(mut occupied) => {
	let set = occupied.get_mut();
	if set.len() >= self.max_connections_per_ip {
	return Err(ConnectionDenied::new(
	"Max connections per IP reached",
	))
	}
	set.insert(peer);
	}
	Entry::Vacant(_) => {
	// Do nothing
	}
	}
	if let Some(peers) = self.ips_to_peers.get_mut(&ip) {
	if peers.len() >= self.max_connections_per_ip {
	return Err(ConnectionDenied::new(
	"Max connections per IP reached",
	))
	}
	peers.insert(peer);
	}

[Dentosal]

Suggested change

	let ip = get_ip_addr(send_back_addr);
	if let Some(ip) = ip {
	let entry = self.ips_to_peers.entry(ip);
	match entry {
	Entry::Occupied(mut occupied) => {
	let set = occupied.get_mut();
	set.remove(&peer_id);
	if set.is_empty() {
	occupied.remove();
	}
	}
	Entry::Vacant(_) => {
	tracing::warn!(
	"IP address not found in the \
	map during disconnection of the peer {:?}",
	peer_id
	)
	}
	}
	}
	if let Some(ip) = get_ip_addr(send_back_addr) {
	if let Some(peers) = self.ips_to_peers.get_mut(&ip) {
	peers.remove(&peer_id);
	if peers.is_empty() {
	self.ips_to_peers.remove(&ip);
	}
	} else {
	tracing::warn!(
	"IP address not found in the \
	map during disconnection of the peer {:?}",
	peer_id
	)
	}
	}