* Throttle: Reject tunnels for first 20m uptime (was 10m)

* TunnelPeerSelectors:
       - Re-enable strict ordering of peers,
         based on XOR distance from a random hash
       - Restrict peers with uptime < 90m from tunnels (was 2h),
         which is really 60m due to rounding in netDb publishing.
    * i2psnark:
       - Limit max pipelined requests from a single peer to 128KB
         (was unlimited; i2p-bt default is 5 * 64KB)
       - Increase max uploaders per torrent to 6 (was 4)
       - Reduce max connections per torrent to 16 (was 24) to increase
         unchoke time and reduce memory consumption
       - Strictly enforce max connections per torrent
       - Choke more gradually when over BW limit
    * help.jsp: Add a link to the FAQ
    * peers.jsp: Fix UDP direction indicators
    * hosts.txt: Add update.postman.i2p

apps/i2psnark/java/src/org/klomp/snark/PeerState.java

@@ -62,7 +62,8 @@ class PeerState
   // If we have te resend outstanding requests (true after we got choked).
   private boolean resend = false;
 
-  private final static int MAX_PIPELINE = 2;
+  private final static int MAX_PIPELINE = 2;               // this is for outbound requests
+  private final static int MAX_PIPELINE_BYTES = 128*1024;  // this is for inbound requests
   private final static int PARTSIZE = 32*1024; // Snark was 16K, i2p-bt uses 64KB
   private final static int MAX_PARTSIZE = 64*1024; // Don't let anybody request more than this
 
@@ -185,6 +186,15 @@ class PeerState
         return;
       }
 
+    // Limit total pipelined requests to MAX_PIPELINE bytes
+    // to conserve memory and prevent DOS
+    if (out.queuedBytes() + length > MAX_PIPELINE_BYTES)
+      {
+        if (_log.shouldLog(Log.WARN))
+          _log.warn("Discarding request over pipeline limit from " + peer);
+        return;
+      }
+
     byte[] pieceBytes = listener.gotRequest(peer, piece, begin, length);
     if (pieceBytes == null)
       {