From afa727808025b7af8feecc4b495668a589ab6b2d Mon Sep 17 00:00:00 2001
From: zzz <zzz@i2pmail.org>
Date: Tue, 25 Jan 2022 12:22:57 -0500
Subject: [PATCH] NTCP: Ban IP if RI signature fails

---
 .../router/transport/ntcp/InboundEstablishState.java  | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/router/java/src/net/i2p/router/transport/ntcp/InboundEstablishState.java b/router/java/src/net/i2p/router/transport/ntcp/InboundEstablishState.java
index e64c9f7c0..0f45d47cf 100644
--- a/router/java/src/net/i2p/router/transport/ntcp/InboundEstablishState.java
+++ b/router/java/src/net/i2p/router/transport/ntcp/InboundEstablishState.java
@@ -471,10 +471,17 @@ class InboundEstablishState extends EstablishBase implements NTCP2Payload.Payloa
             } catch (DataFormatException dfe) {
                 if (_log.shouldWarn())
                     _log.warn("Bad msg 3 payload", dfe);
-                // probably RI problems
+                // probably RI signature failure
                 // setDataPhase() will send termination
-                if (_msg3p2FailReason < 0)
+                if (_msg3p2FailReason < 0) {
                     _msg3p2FailReason = NTCPConnection.REASON_SIGFAIL;
+                    // buggy/forked and very persistent i2pd
+                    // So next time we will not accept the con from this IP,
+                    // rather than doing the whole handshake
+                    byte[] ip = _con.getRemoteIP();
+                    if (ip != null)
+                        _context.blocklist().add(ip);
+                }
                 _context.statManager().addRateData("ntcp.invalidInboundSignature", 1);
             } catch (I2NPMessageException ime) {
                 // shouldn't happen, no I2NP msgs in msg3p2