src/network/connectionthreads.cpp

@@ -44,6 +44,8 @@ namespace con
 // TODO: Clean this up.
 #define LOG(a) a
 
+#define MAX_NEW_PEERS_PER_SEC 30
+
 static inline session_t readPeerId(const u8 *packetdata)
 {
 	return readU16(&packetdata[4]);
@@ -971,9 +973,21 @@ void ConnectionReceiveThread::receive(SharedBuffer<u8> &packetdata,
 
 			// Someone new is trying to talk to us. Add them.
 			if (peer_id == PEER_ID_INEXISTENT) {
+				auto &l = m_new_peer_ratelimit;
+				l.tick();
+				if (++l.counter > MAX_NEW_PEERS_PER_SEC) {
+					if (!l.logged) {
+						warningstream << m_connection->getDesc()
+							<< "Receive(): More than " << MAX_NEW_PEERS_PER_SEC
+							<< " new clients within 1s. Throttling." << std::endl;
+					}
+					l.logged = true;
+					// We simply drop the packet, the client can try again.
+				} else {
 					peer_id = m_connection->createPeer(sender, MTP_MINETEST_RELIABLE_UDP, 0);
 				}
 			}
+		}
 
 		PeerHelper peer = m_connection->getPeerNoEx(peer_id);
 		if (!peer) {

src/network/connectionthreads.h

@@ -162,8 +162,25 @@ private:
 				bool reliable);
 	};
 
+	struct RateLimitHelper {
+		u64 time = 0;
+		int counter = 0;
+		bool logged = false;
+
+		void tick() {
+			u64 now = porting::getTimeS();
+			if (time != now) {
+				time = now;
+				counter = 0;
+				logged = false;
+			}
+		}
+	};
+
 	static const PacketTypeHandler packetTypeRouter[PACKET_TYPE_MAX];
 
 	Connection *m_connection = nullptr;
+
+	RateLimitHelper m_new_peer_ratelimit;
 };
 }