Security: Limit the number of initial connection attempts to seed peers

[teor2345]

Motivation

Sometimes, Zebra can get over a hundred IP addresses from the DNS seeders.
Then Zebra attempts to connect to each of these IP addresses.

If Zebra gets caught in a restart loop, this is a denial of service risk.

This might also fix bugs like #2905, if the hang happens because a channel is full.

Suggested Design

Limit the number of initial seed IP addresses to peerset_initial_target_size in add_initial_peers. This applies the rate limit before Zebra does any work.

peerset_initial_target_size is an existing zebra-network config. It's used to initialise the CandidateSet's outbound peer connection demand.

Edge Cases

The limit shouldn't favour IPv4 or IPv6 addresses.

We should impose the limit before we connect to any peers. That way, we do as little work as possible on dropped addresses.

Rejected Alternatives

We could use the channel mechanism from #2904, but it's more complicated. It might also be more fragile while Zebra is starting up, because some channels block until Zebra has done its first crawl.

Related Work

These tickets modify the same functions as this ticket:

• Security: Rate-limit initial seed peer connections #2326