Security: Rate-limit inbound peer connection attempts

[teor2345]

Motivation

Zebra doesn't rate-limit inbound peer connection attempts.

This makes it easier for an attacker to overwhelm a node with handshake attempts.

It also makes it possible for an attacker to trigger a large number of connections from other nodes, and use Zebra as the target of those connections.

Suggested Design

In accept_inbound_connections, make sure only one connection is accepted per MIN_PEER_CONNECTION_INTERVAL. This applies the rate limit as soon as Zebra gets control of the connection from tokio.

MIN_PEER_CONNECTION_INTERVAL is the existing rate-limit for outbound CandidateSet connections.

Edge Cases

Once a connection has been accepted, we want to spawn it without any delays. Otherwise, Zebra will be slower to respond to peers. And it will disconnect from invalid peers more slowly.

Related Work

These tickets modify the same functions as this ticket:

• Security: Limit the number of inbound peer connections in the listener task #1851

[teor2345]

Marking this task as medium-priority, because it is simple, and nothing depends on it.
(Except the beta release.)