Tunnels: Restore support for IP restriction in client tunnels

Removed in May 2011 when we added fast tier slices
Add support in exploratory tunnels
Create MaskedIPSet in peer selectors, pass to ProfileOrganizer.selectXXX() for each call.
Not required for one-hop tunnels.
Disable for test networks (i2np.allowLocal)
Reported by 'vulnerability_reports' http://zzz.i2p/topics/3215
Briefly tested, to be reviewed and fully tested

router/java/src/net/i2p/router/peermanager/ProfileOrganizer.java

@@ -407,7 +407,7 @@ public class ProfileOrganizer {
      *
      */
     public void selectFastPeers(int howMany, Set<Hash> exclude, Set<Hash> matches) {
-        selectFastPeers(howMany, exclude, matches, 0);
+        selectFastPeers(howMany, exclude, matches, 0, null);
     }
 
     /**
@@ -421,17 +421,19 @@ public class ProfileOrganizer {
      * @param matches set to store the return value in
      * @param mask 0-4 Number of bytes to match to determine if peers in the same IP range should
      *             not be in the same tunnel. 0 = disable check; 1 = /8; 2 = /16; 3 = /24; 4 = exact IP match
+     * @param ipSet in/out param, use for multiple calls, may be null only if mask is 0
+     * @since 0.9.53 added ipSet param
      *
      */
-    public void selectFastPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, int mask) {
+    public void selectFastPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, int mask, MaskedIPSet ipSet) {
         getReadLock();
         try {
-            locked_selectPeers(_fastPeers, howMany, exclude, matches, mask);
+            locked_selectPeers(_fastPeers, howMany, exclude, matches, mask, ipSet);
         } finally { releaseReadLock(); }
         if (matches.size() < howMany) {
             if (_log.shouldLog(Log.INFO))
                 _log.info("selectFastPeers("+howMany+"), not enough fast (" + matches.size() + ") going on to highCap");
-            selectHighCapacityPeers(howMany, exclude, matches, mask);
+            selectHighCapacityPeers(howMany, exclude, matches, mask, ipSet);
         } else {
             if (_log.shouldDebug())
                 _log.debug("selectFastPeers("+howMany+"), found enough fast (" + matches.size() + ")");
@@ -482,8 +484,12 @@ public class ProfileOrganizer {
      *    6: return only from group 2
      *    7: return only from group 3
      *</pre>
+     * @param mask 0-4
+     * @param ipSet in/out param, use for multiple calls, may be null only if mask is 0
+     * @since 0.9.53 added mask and ipSet params
      */
-    public void selectFastPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, SessionKey randomKey, Slice subTierMode) {
+    public void selectFastPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, SessionKey randomKey,
+                                Slice subTierMode, int mask, MaskedIPSet ipSet) {
         getReadLock();
         try {
             if (subTierMode != Slice.SLICE_ALL) {
@@ -492,14 +498,14 @@ public class ProfileOrganizer {
                     subTierMode = Slice.SLICE_ALL;
             }
             if (subTierMode != Slice.SLICE_ALL)
-                locked_selectPeers(_fastPeers, howMany, exclude, matches, randomKey, subTierMode);
+                locked_selectPeers(_fastPeers, howMany, exclude, matches, randomKey, subTierMode, mask, ipSet);
             else
-                locked_selectPeers(_fastPeers, howMany, exclude, matches, 2);
+                locked_selectPeers(_fastPeers, howMany, exclude, matches, mask, ipSet);
         } finally { releaseReadLock(); }
         if (matches.size() < howMany) {
             if (_log.shouldLog(Log.INFO))
                 _log.info("selectFastPeers("+howMany+"), not enough fast (" + matches.size() + ") going on to highCap");
-            selectHighCapacityPeers(howMany, exclude, matches, 2);
+            selectHighCapacityPeers(howMany, exclude, matches, mask, ipSet);
         } else {
             if (_log.shouldDebug())
                 _log.debug("selectFastPeers("+howMany+"), found enough fast (" + matches.size() + ")");
@@ -512,14 +518,16 @@ public class ProfileOrganizer {
      *
      */
     public void selectHighCapacityPeers(int howMany, Set<Hash> exclude, Set<Hash> matches) {
-        selectHighCapacityPeers(howMany, exclude, matches, 0);
+        selectHighCapacityPeers(howMany, exclude, matches, 0, null);
     }
 
     /**
      * @param mask 0-4 Number of bytes to match to determine if peers in the same IP range should
      *             not be in the same tunnel. 0 = disable check; 1 = /8; 2 = /16; 3 = /24; 4 = exact IP match
+     * @param ipSet in/out param, use for multiple calls, may be null only if mask is 0
+     * @since 0.9.53 added ipSet param
      */
-    public void selectHighCapacityPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, int mask) {
+    public void selectHighCapacityPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, int mask, MaskedIPSet ipSet) {
         getReadLock();
         try {
             // we only use selectHighCapacityPeers when we are selecting for PURPOSE_TEST
@@ -531,12 +539,12 @@ public class ProfileOrganizer {
             else
                 exclude.addAll(_fastPeers.keySet());
              */
-            locked_selectPeers(_highCapacityPeers, howMany, exclude, matches, mask);
+            locked_selectPeers(_highCapacityPeers, howMany, exclude, matches, mask, ipSet);
         } finally { releaseReadLock(); }
         if (matches.size() < howMany) {
             if (_log.shouldLog(Log.INFO))
                 _log.info("selectHighCap("+howMany+"), not enough highcap (" + matches.size() + ") going on to ANFP2");
-            selectActiveNotFailingPeers2(howMany, exclude, matches, mask);
+            selectActiveNotFailingPeers2(howMany, exclude, matches, mask, ipSet);
         } else {
             if (_log.shouldDebug())
                 _log.debug("selectHighCap("+howMany+"), found enough highCap (" + matches.size() + ")");
@@ -551,7 +559,7 @@ public class ProfileOrganizer {
      */
     @Deprecated
     public void selectWellIntegratedPeers(int howMany, Set<Hash> exclude, Set<Hash> matches) {
-        selectWellIntegratedPeers(howMany, exclude, matches, 0);
+        selectWellIntegratedPeers(howMany, exclude, matches, 0, null);
     }
 
     /**
@@ -559,18 +567,19 @@ public class ProfileOrganizer {
      *
      * @param mask 0-4 Number of bytes to match to determine if peers in the same IP range should
      *             not be in the same tunnel. 0 = disable check; 1 = /8; 2 = /16; 3 = /24; 4 = exact IP match
+     * @since 0.9.53 added ipSet param
      * @deprecated unused
      */
     @Deprecated
-    public void selectWellIntegratedPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, int mask) {
+    public void selectWellIntegratedPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, int mask, MaskedIPSet ipSet) {
         getReadLock();
         try {
-            locked_selectPeers(_wellIntegratedPeers, howMany, exclude, matches, mask);
+            locked_selectPeers(_wellIntegratedPeers, howMany, exclude, matches, mask, ipSet);
         } finally { releaseReadLock(); }
         if (matches.size() < howMany) {
             if (_log.shouldLog(Log.INFO))
                 _log.info("selectWellIntegrated("+howMany+"), not enough integrated (" + matches.size() + ") going on to notFailing");
-            selectNotFailingPeers(howMany, exclude, matches, mask);
+            selectNotFailingPeers(howMany, exclude, matches, mask, ipSet);
         } else {            
             if (_log.shouldDebug())
                 _log.debug("selectWellIntegrated("+howMany+"), found enough well integrated (" + matches.size() + ")");
@@ -585,18 +594,20 @@ public class ProfileOrganizer {
      *
      */
     public void selectNotFailingPeers(int howMany, Set<Hash> exclude, Set<Hash> matches) {
-        selectNotFailingPeers(howMany, exclude, matches, false, 0);
+        selectNotFailingPeers(howMany, exclude, matches, false, 0, null);
     }
 
     /**
      * @param mask ignored, should call locked_selectPeers, to be fixed
+     * @param ipSet ignored, should call locked_selectPeers, to be fixed
+     * @since 0.9.53 added ipSet param
      */
-    public void selectNotFailingPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, int mask) {
-        selectNotFailingPeers(howMany, exclude, matches, false, mask);
+    public void selectNotFailingPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, int mask, MaskedIPSet ipSet) {
+        selectNotFailingPeers(howMany, exclude, matches, false, mask, ipSet);
     }
 
     public void selectNotFailingPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, boolean onlyNotFailing) {
-        selectNotFailingPeers(howMany, exclude, matches, onlyNotFailing, 0);
+        selectNotFailingPeers(howMany, exclude, matches, onlyNotFailing, 0, null);
     }
 
     /**
@@ -608,8 +619,11 @@ public class ProfileOrganizer {
      * @param matches set to store the matches in
      * @param onlyNotFailing if true, don't include any high capacity peers
      * @param mask ignored, should call locked_selectPeers, to be fixed
+     * @param ipSet ignored, should call locked_selectPeers, to be fixed
+     * @since 0.9.53 added ipSet param
      */
-    public void selectNotFailingPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, boolean onlyNotFailing, int mask) {
+    public void selectNotFailingPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, boolean onlyNotFailing,
+                                      int mask, MaskedIPSet ipSet) {
         if (matches.size() < howMany)
             selectAllNotFailingPeers(howMany, exclude, matches, onlyNotFailing, mask);
         return;
@@ -627,9 +641,30 @@ public class ProfileOrganizer {
      * be used when there is a good number of connected peers.
      *
      * @param exclude non-null, WARNING - side effect, all not-connected peers are added
-     * No mask parameter, to be fixed
      */
     public void selectActiveNotFailingPeers(int howMany, Set<Hash> exclude, Set<Hash> matches) {
+        selectActiveNotFailingPeers(howMany, exclude, matches, 0, null);
+    }
+
+    /**
+     * Return a set of Hashes for peers that are both not failing and we're actively
+     * talking with.
+     *
+     * We use commSystem().isEstablished(), not profile.getIsActive(), as the
+     * NTCP idle time is now shorter than the 5 minute getIsActive() threshold,
+     * and we're using this to try and limit connections.
+     *
+     * Caution, this does NOT cascade further to non-connected peers, so it should only
+     * be used when there is a good number of connected peers.
+     *
+     * @param exclude non-null, WARNING - side effect, all not-connected peers are added
+     * @param mask 0-4 Number of bytes to match to determine if peers in the same IP range should
+     *             not be in the same tunnel. 0 = disable check; 1 = /8; 2 = /16; 3 = /24; 4 = exact IP match
+     * @param ipSet ignored, should call locked_selectPeers, to be fixed
+     * @param ipSet may be null only if mask is 0
+     * @since 0.9.53
+     */
+    public void selectActiveNotFailingPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, int mask, MaskedIPSet ipSet) {
         if (matches.size() < howMany) {
             Set<Hash> connected = _context.commSystem().getEstablished();
             getReadLock();
@@ -638,7 +673,7 @@ public class ProfileOrganizer {
                     if (!connected.contains(peer))
                         exclude.add(peer);
                 }
-                locked_selectPeers(_notFailingPeers, howMany, exclude, matches, 0);
+                locked_selectPeers(_notFailingPeers, howMany, exclude, matches, mask, ipSet);
             } finally { releaseReadLock(); }
         }
     }
@@ -655,8 +690,10 @@ public class ProfileOrganizer {
      *
      * @param mask 0-4 Number of bytes to match to determine if peers in the same IP range should
      *             not be in the same tunnel. 0 = disable check; 1 = /8; 2 = /16; 3 = /24; 4 = exact IP match
+     * @param ipSet in/out param, use for multiple calls, may be null only if mask is 0
+     * @since 0.9.53 added ipSet param
      */
-    private void selectActiveNotFailingPeers2(int howMany, Set<Hash> exclude, Set<Hash> matches, int mask) {
+    private void selectActiveNotFailingPeers2(int howMany, Set<Hash> exclude, Set<Hash> matches, int mask, MaskedIPSet ipSet) {
         if (matches.size() < howMany) {
             Set<Hash> connected = _context.commSystem().getEstablished();
             Map<Hash, PeerProfile> activePeers = new HashMap<Hash, PeerProfile>(connected.size());
@@ -667,13 +704,13 @@ public class ProfileOrganizer {
                     if (prof != null)
                         activePeers.put(peer, prof);
                 }
-                locked_selectPeers(activePeers, howMany, exclude, matches, mask);
+                locked_selectPeers(activePeers, howMany, exclude, matches, mask, ipSet);
             } finally { releaseReadLock(); }
         }
         if (matches.size() < howMany) {
             if (_log.shouldLog(Log.INFO))
                 _log.info("selectANFP2("+howMany+"), not enough ANFP (" + matches.size() + ") going on to notFailing");
-            selectNotFailingPeers(howMany, exclude, matches, mask);
+            selectNotFailingPeers(howMany, exclude, matches, mask, ipSet);
         } else {
             if (_log.shouldDebug())
                 _log.debug("selectANFP2("+howMany+"), found enough ANFP (" + matches.size() + ")");
@@ -690,7 +727,6 @@ public class ProfileOrganizer {
 
     /**
      * @param mask ignored, should call locked_selectPeers, to be fixed
-     *
      */
     private void selectAllNotFailingPeers(int howMany, Set<Hash> exclude, Set<Hash> matches, boolean onlyNotFailing, int mask) {
         if (matches.size() < howMany) {
@@ -1287,19 +1323,21 @@ public class ProfileOrganizer {
      *
      */
     private void locked_selectPeers(Map<Hash, PeerProfile> peers, int howMany, Set<Hash> toExclude, Set<Hash> matches) {
-        locked_selectPeers(peers, howMany, toExclude, matches, 0);
+        locked_selectPeers(peers, howMany, toExclude, matches, 0, null);
     }
 
     /**
-      *
-      * As of 0.9.24, checks for a netdb family match as well, unless mask == 0.
-      *
+     *
+     * As of 0.9.24, checks for a netdb family match as well, unless mask == 0.
+     *
      * @param mask 0-4 Number of bytes to match to determine if peers in the same IP range should
      *             not be in the same tunnel. 0 = disable check; 1 = /8; 2 = /16; 3 = /24; 4 = exact IP match
+     * @param ipSet may be null only if mask is 0
+     * @since 0.9.53 added ipSet param
      */
-    private void locked_selectPeers(Map<Hash, PeerProfile> peers, int howMany, Set<Hash> toExclude, Set<Hash> matches, int mask) {
+    private void locked_selectPeers(Map<Hash, PeerProfile> peers, int howMany, Set<Hash> toExclude, Set<Hash> matches,
+                                    int mask, MaskedIPSet ipSet) {
         List<Hash> all = new ArrayList<Hash>(peers.keySet());
-        MaskedIPSet IPSet = new MaskedIPSet(16);
         // use RandomIterator to avoid shuffling the whole thing
         for (Iterator<Hash> iter = new RandomIterator<Hash>(all); (matches.size() < howMany) && iter.hasNext(); ) {
             Hash peer = iter.next();
@@ -1311,7 +1349,7 @@ public class ProfileOrganizer {
                 continue;
             boolean ok = isSelectable(peer);
             if (ok) {
-                ok = mask <= 0 || notRestricted(peer, IPSet, mask);
+                ok = mask <= 0 || notRestricted(peer, ipSet, mask);
                 if ((!ok) && _log.shouldLog(Log.WARN))
                     _log.warn("IP restriction prevents " + peer + " from joining " + matches);
             }
@@ -1350,9 +1388,13 @@ public class ProfileOrganizer {
      *    6: return only from group 2
      *    7: return only from group 3
      *</pre>
+     * @param mask is 1-4 (number of bytes to match)
+     * @param IPMatches all IPs so far, modified by this routine
+     * @since 0.9.53 added mask/ipSet params
      */
     private void locked_selectPeers(Map<Hash, PeerProfile> peers, int howMany, Set<Hash> toExclude,
-                                    Set<Hash> matches, SessionKey randomKey, Slice subTierMode) {
+                                    Set<Hash> matches, SessionKey randomKey, Slice subTierMode,
+                                    int mask, MaskedIPSet ipSet) {
         List<Hash> all = new ArrayList<Hash>(peers.keySet());
         byte[] rk = randomKey.getData();
         // we use the first half of the random key here,
@@ -1373,6 +1415,11 @@ public class ProfileOrganizer {
             if ((subTier & subTierMode.mask) != subTierMode.val)
                 continue;
             boolean ok = isSelectable(peer);
+            if (ok) {
+                ok = mask <= 0 || notRestricted(peer, ipSet, mask);
+                if ((!ok) && _log.shouldLog(Log.WARN))
+                    _log.warn("IP restriction prevents " + peer + " from joining " + matches);
+            }
             if (ok)
                 matches.add(peer);
             else

router/java/src/net/i2p/router/tunnel/pool/ClientPeerSelector.java

@@ -13,6 +13,7 @@ import net.i2p.router.TunnelInfo;
 import net.i2p.router.TunnelManagerFacade;
 import net.i2p.router.TunnelPoolSettings;
 import static net.i2p.router.peermanager.ProfileOrganizer.Slice.*;
+import net.i2p.router.util.MaskedIPSet;
 
 /**
  * Pick peers randomly out of the fast pool, and put them into tunnels
@@ -57,6 +58,8 @@ class ClientPeerSelector extends TunnelPeerSelector {
                              !ctx.commSystem().haveInboundCapacity(95);
             boolean hiddenInbound = hidden && isInbound;
             boolean hiddenOutbound = hidden && !isInbound;
+            int ipRestriction =  (ctx.getBooleanProperty("i2np.allowLocal") || length <= 1) ? 0 : settings.getIPRestriction();
+            MaskedIPSet ipSet = ipRestriction > 0 ? new MaskedIPSet(16) : null;
 
             if (shouldSelectExplicit(settings))
                 return selectExplicit(settings, length);
@@ -70,6 +73,7 @@ class ClientPeerSelector extends TunnelPeerSelector {
                     if (moreExclude != null)
                         exclude.addAll(moreExclude);
                 }
+                // 1-hop, IP restrictions not required here
                 if (hiddenInbound) {
                     // SANFP adds all not-connected to exclude, so make a copy
                     Set<Hash> SANFPExclude = new HashSet<Hash>(exclude);
@@ -77,7 +81,7 @@ class ClientPeerSelector extends TunnelPeerSelector {
                 }
                 if (matches.isEmpty()) {
                     // ANFP does not fall back to non-connected
-                    ctx.profileOrganizer().selectFastPeers(length, exclude, matches, 0);
+                    ctx.profileOrganizer().selectFastPeers(length, exclude, matches);
                 }
                 matches.remove(ctx.routerHash());
                 rv = new ArrayList<Hash>(matches);
@@ -113,12 +117,12 @@ class ClientPeerSelector extends TunnelPeerSelector {
                         log.info("CPS SANFP closest IB exclude " + lastHopExclude.size());
                     // SANFP adds all not-connected to exclude, so make a copy
                     Set<Hash> SANFPExclude = new HashSet<Hash>(lastHopExclude);
-                    ctx.profileOrganizer().selectActiveNotFailingPeers(1, SANFPExclude, matches);
+                    ctx.profileOrganizer().selectActiveNotFailingPeers(1, SANFPExclude, matches, ipRestriction, ipSet);
                     if (matches.isEmpty()) {
                         if (log.shouldInfo())
                             log.info("CPS SFP closest IB exclude " + lastHopExclude.size());
                         // ANFP does not fall back to non-connected
-                        ctx.profileOrganizer().selectFastPeers(1, lastHopExclude, matches, randomKey, length == 2 ? SLICE_0_1 : SLICE_0);
+                        ctx.profileOrganizer().selectFastPeers(1, lastHopExclude, matches, randomKey, length == 2 ? SLICE_0_1 : SLICE_0, ipRestriction, ipSet);
                     }
                 } else if (hiddenOutbound) {
                     // OBEP
@@ -177,19 +181,19 @@ class ClientPeerSelector extends TunnelPeerSelector {
                             log.info("CPS SANFP OBEP exclude " + lastHopExclude.size());
                         // SANFP adds all not-connected to exclude, so make a copy
                         Set<Hash> SANFPExclude = new HashSet<Hash>(lastHopExclude);
-                        ctx.profileOrganizer().selectActiveNotFailingPeers(1, SANFPExclude, matches);
+                        ctx.profileOrganizer().selectActiveNotFailingPeers(1, SANFPExclude, matches, ipRestriction, ipSet);
                         if (matches.isEmpty()) {
                             // ANFP does not fall back to non-connected
                             if (log.shouldInfo())
                                 log.info("CPS SFP OBEP exclude " + lastHopExclude.size());
-                            ctx.profileOrganizer().selectFastPeers(1, lastHopExclude, matches, randomKey, length == 2 ? SLICE_0_1 : SLICE_0);
+                            ctx.profileOrganizer().selectFastPeers(1, lastHopExclude, matches, randomKey, length == 2 ? SLICE_0_1 : SLICE_0, ipRestriction, ipSet);
                         }
                     } else {
-                        ctx.profileOrganizer().selectFastPeers(1, lastHopExclude, matches, randomKey, length == 2 ? SLICE_0_1 : SLICE_0);
+                        ctx.profileOrganizer().selectFastPeers(1, lastHopExclude, matches, randomKey, length == 2 ? SLICE_0_1 : SLICE_0, ipRestriction, ipSet);
                     }
                 } else {
                     // TODO exclude IPv6-only at OBEP? Caught in checkTunnel() below
-                    ctx.profileOrganizer().selectFastPeers(1, lastHopExclude, matches, randomKey, length == 2 ? SLICE_0_1 : SLICE_0);
+                    ctx.profileOrganizer().selectFastPeers(1, lastHopExclude, matches, randomKey, length == 2 ? SLICE_0_1 : SLICE_0, ipRestriction, ipSet);
                 }
 
                 matches.remove(ctx.routerHash());
@@ -199,7 +203,7 @@ class ClientPeerSelector extends TunnelPeerSelector {
                 if (length > 2) {
                     // middle hop(s)
                     // group 2 or 3
-                    ctx.profileOrganizer().selectFastPeers(length - 2, exclude, matches, randomKey, SLICE_2_3);
+                    ctx.profileOrganizer().selectFastPeers(length - 2, exclude, matches, randomKey, SLICE_2_3, ipRestriction, ipSet);
                     matches.remove(ctx.routerHash());
                     if (matches.size() > 1) {
                         // order the middle peers for tunnels >= 4 hops
@@ -225,7 +229,7 @@ class ClientPeerSelector extends TunnelPeerSelector {
                     }
                 }
                 // TODO exclude IPv6-only at IBGW? Caught in checkTunnel() below
-                ctx.profileOrganizer().selectFastPeers(1, exclude, matches, randomKey, length == 2 ? SLICE_2_3 : SLICE_1);
+                ctx.profileOrganizer().selectFastPeers(1, exclude, matches, randomKey, length == 2 ? SLICE_2_3 : SLICE_1, ipRestriction, ipSet);
                 matches.remove(ctx.routerHash());
                 rv.addAll(matches);
             }

router/java/src/net/i2p/router/tunnel/pool/ExploratoryPeerSelector.java

@@ -11,6 +11,7 @@ import net.i2p.router.RouterContext;
 import net.i2p.router.TunnelInfo;
 import net.i2p.router.TunnelManagerFacade;
 import net.i2p.router.TunnelPoolSettings;
+import net.i2p.router.util.MaskedIPSet;
 import net.i2p.stat.Rate;
 import net.i2p.stat.RateStat;
 import net.i2p.util.Log;
@@ -70,6 +71,8 @@ class ExploratoryPeerSelector extends TunnelPeerSelector {
         boolean hiddenInbound = hidden && isInbound;
         boolean hiddenOutbound = hidden && !isInbound;
         boolean lowOutbound = nonzero && !isInbound && !ctx.commSystem().haveHighOutboundCapacity();
+        int ipRestriction =  (ctx.getBooleanProperty("i2np.allowLocal") || length <= 1) ? 0 : settings.getIPRestriction();
+        MaskedIPSet ipSet = ipRestriction > 0 ? new MaskedIPSet(16) : null;
 
 
         // closest-hop restrictions
@@ -99,21 +102,21 @@ class ExploratoryPeerSelector extends TunnelPeerSelector {
                     log.info("EPS SANFP closest " + (isInbound ? "IB" : "OB") + " exclude " + closestExclude.size());
                 // SANFP adds all not-connected to exclude, so make a copy
                 Set<Hash> SANFPExclude = new HashSet<Hash>(closestExclude);
-                ctx.profileOrganizer().selectActiveNotFailingPeers(1, SANFPExclude, closest);
+                ctx.profileOrganizer().selectActiveNotFailingPeers(1, SANFPExclude, closest, ipRestriction, ipSet);
                 if (closest.isEmpty()) {
                     // ANFP does not fall back to non-connected
                     if (log.shouldLog(Log.INFO))
                         log.info("EPS SFP closest " + (isInbound ? "IB" : "OB") + " exclude " + closestExclude.size());
-                    ctx.profileOrganizer().selectFastPeers(1, closestExclude, closest);
+                    ctx.profileOrganizer().selectFastPeers(1, closestExclude, closest, ipRestriction, ipSet);
                 }
             } else if (exploreHighCap) {
                 if (log.shouldLog(Log.INFO))
                     log.info("EPS SHCP closest " + (isInbound ? "IB" : "OB") + " exclude " + closestExclude.size());
-                ctx.profileOrganizer().selectHighCapacityPeers(1, closestExclude, closest);
+                ctx.profileOrganizer().selectHighCapacityPeers(1, closestExclude, closest, ipRestriction, ipSet);
             } else {
                 if (log.shouldLog(Log.INFO))
                     log.info("EPS SNFP closest " + (isInbound ? "IB" : "OB") + " exclude " + closestExclude.size());
-                ctx.profileOrganizer().selectNotFailingPeers(1, closestExclude, closest, false);
+                ctx.profileOrganizer().selectNotFailingPeers(1, closestExclude, closest, false, ipRestriction, ipSet);
             }
             if (!closest.isEmpty()) {
                 closestHop = closest.iterator().next();
@@ -155,12 +158,12 @@ class ExploratoryPeerSelector extends TunnelPeerSelector {
                     log.info("EPS SANFP furthest OB exclude " + exclude.size());
                 // ANFP adds all not-connected to exclude, so make a copy
                 Set<Hash> SANFPExclude = new HashSet<Hash>(exclude);
-                ctx.profileOrganizer().selectActiveNotFailingPeers(1, SANFPExclude, furthest);
+                ctx.profileOrganizer().selectActiveNotFailingPeers(1, SANFPExclude, furthest, ipRestriction, ipSet);
                 if (furthest.isEmpty()) {
                     // ANFP does not fall back to non-connected
                     if (log.shouldLog(Log.INFO))
                         log.info("EPS SFP furthest OB exclude " + exclude.size());
-                    ctx.profileOrganizer().selectFastPeers(1, exclude, furthest);
+                    ctx.profileOrganizer().selectFastPeers(1, exclude, furthest, ipRestriction, ipSet);
                 }
                 if (!furthest.isEmpty()) {
                     furthestHop = furthest.iterator().next();
@@ -179,13 +182,10 @@ class ExploratoryPeerSelector extends TunnelPeerSelector {
         HashSet<Hash> matches = new HashSet<Hash>(length);
 
         if (length > 0) {
-            //
-            // We don't honor IP Restriction here, to be fixed
-            //
             if (exploreHighCap) {
                 if (log.shouldLog(Log.INFO))
                     log.info("EPS SHCP " + length + (isInbound ? " IB" : " OB") + " exclude " + exclude.size());
-                ctx.profileOrganizer().selectHighCapacityPeers(length, exclude, matches);
+                ctx.profileOrganizer().selectHighCapacityPeers(length, exclude, matches, ipRestriction, ipSet);
             } else {
                 // As of 0.9.23, we include a max of 2 not failing peers,
                 // to improve build success on 3-hop tunnels.
@@ -194,7 +194,7 @@ class ExploratoryPeerSelector extends TunnelPeerSelector {
                     ctx.profileOrganizer().selectHighCapacityPeers(length - 2, exclude, matches);
                 if (log.shouldLog(Log.INFO))
                     log.info("EPS SNFP " + length + (isInbound ? " IB" : " OB") + " exclude " + exclude.size());
-                ctx.profileOrganizer().selectNotFailingPeers(length, exclude, matches, false);
+                ctx.profileOrganizer().selectNotFailingPeers(length, exclude, matches, false, ipRestriction, ipSet);
             }
             matches.remove(ctx.routerHash());
         }

router/java/src/net/i2p/router/tunnel/pool/TunnelPeerSelector.java

@@ -166,7 +166,8 @@ public abstract class TunnelPeerSelector extends ConnectChecker {
             Set<Hash> exclude = getExclude(settings.isInbound(), settings.isExploratory());
             exclude.addAll(rv);
             Set<Hash> matches = new HashSet<Hash>(more);
-            ctx.profileOrganizer().selectFastPeers(more, exclude, matches, 0);
+            // don't bother with IP restrictions here
+            ctx.profileOrganizer().selectFastPeers(more, exclude, matches);
             rv.addAll(matches);
             Collections.shuffle(rv, ctx.random());
         }