Meridian59/Meridian59 — pull request #258 by cyberjunk (2013-11-24 19:50:43+00:00)
Title: Adjusted INCOMING_PACKET_THROTTLE (user.kod)

This patch turns INCOMING_PACKET_THROTTLE constant in user.kod into an always applied, but higher message limit, so it actually serves as some kind of DDoS protection and has a clear purpose.

The "bSpam" handling before did not make sense to me, because:

1) It did not prevent against DDoS, because there were plenty of exclusions, which did not honor this message limit and therefore could be used for DDoS attacks, this included ones which are also propagated to possibly a lot of other clients, like BP_REQ_TURN.

2) It did not serve as a notable protection against unwanted multiple executions, because these need specific limits anyways - e.g. there is a specific value to allow an attack/cast once per second and they do not use this common message-limit as threshold.

The new value 20 was chosen because requesting all necessary data after a server-save cycle takes at least 12 messages sent from the client to the server almost at once which must not fail/be discarded.

IMO this change brings:

a) Better DDoS protection. Sending the biggest/most costly message 20 times per second now probably takes less bandwidth/cpuload than sending one that was not limited before several thousand times a second.

b) This also prepares for a possibly higher update rate of position/orientation

Feedback welcome :)