Limit the number of IPs we use from each DNS seeder

EthanHeilman · EthanHeilman · commit 46e7f800bd78 · 2018-03-06T18:26:29.000-05:00
A risk exists where a malicious DNS seeder eclipses a node by returning an enormous number of IP addresses. In this commit we mitigate this risk by limiting the number of IP addresses addrman learns to 256 per DNS seeder.
diff --git a/src/net.cpp b/src/net.cpp
@@ -1631,7 +1631,8 @@ void CConnman::ThreadDNSAddressSeed()
             if (!resolveSource.SetInternal(host)) {
                 continue;
             }
-            if (LookupHost(host.c_str(), vIPs, 0, true))
+            unsigned int nMaxIPs = 256; // Limits number of IPs learned from a DNS seed
+            if (LookupHost(host.c_str(), vIPs, nMaxIPs, true))
             {
                 for (const CNetAddr& ip : vIPs)
                 {

Original file line number	Diff line number	Diff line change
`@@ -1631,7 +1631,8 @@ void CConnman::ThreadDNSAddressSeed()`
`1631`	`1631`	`if (!resolveSource.SetInternal(host)) {`
`1632`	`1632`	`continue;`
`1633`	`1633`	`}`
`1634`		`- if (LookupHost(host.c_str(), vIPs, 0, true))`
	`1634`	`+ unsigned int nMaxIPs = 256; // Limits number of IPs learned from a DNS seed`
	`1635`	`+ if (LookupHost(host.c_str(), vIPs, nMaxIPs, true))`
`1635`	`1636`	`{`
`1636`	`1637`	`for (const CNetAddr& ip : vIPs)`
`1637`	`1638`	`{`