daemon: stop the KX rate limiter wedging key exchange permanently

[TeoSlayer]

Remote, permanent denial of key exchange

allowKxFromSource tracked one bucket per source IP in kxRateLim and never removed any. There is no delete(tm.kxRateLim, ...) anywhere in the package — the only deletes in tunnel.go are for relayKxLim, lastPendDropLog, lastRekeyReq, pending and peers.

So once maxPerSrcKxEntries (4096) distinct source IPs had ever sent a PILA/PILK frame:

if len(tm.kxRateLim) >= maxPerSrcKxEntries {
    return false
}

…every subsequent new source IP was refused for the life of the process. Key exchange with any new peer was permanently dead, with no recovery short of a restart.

A peer spraying spoofed source IPs fills all 4096 slots in a single burst. That turns a rate limiter into a remote, permanent DoS — and it fails closed, so the daemon looks healthy while quietly refusing every new peer.

The fix was already thirty lines away

The sibling relay limiter calls pruneRelayKxLocked before rejecting. This mirrors it exactly with pruneKxRateLimLocked, reusing relayKxPruneAge (10s).

Pruning costs no rate-limiting accuracy. A bucket idle for 10s has long since refilled — perSourceKxLimit tokens accrue every second — so dropping it is equivalent to keeping it: the next frame from that IP recreates it with a full budget.

Tests

• a full table of stale entries must still admit a new peer — fails against the unfixed code
• a full table of active entries must still refuse, proving the prune is a reclaim and not a hole in the cap
• the per-source budget is unchanged
• the pre-existing TestKxRateLimiterMaxEntries still passes

Full pkg/daemon suite green (21.6s).

Provenance

Found during a codebase-wide sweep for safety mechanisms that silently fail to engage — the same class as the dead idle-timeout that OOM-killed the service fleet, and as connAdapter.SetReadDeadline returning nil without storing anything.

🤖 Generated with Claude Code