Introduce MAX_HIST environment variable.

docs/ENV-NOTES

@@ -44,6 +44,14 @@ in ElectrumX are very cheap - they consume about 100 bytes of memory
 each and are processed efficiently.  I feel the defaults are low and
 encourage you to raise them.
 
+MAX_HIST         - maximum number of historical transactions to serve for an
+                   address.  The current Electrum protocol requires
+                   address histories be served en-masse or not at all,
+                   an obvious avenue for abuse.  This limit is a stop-gap
+                   until the protocol is improved to admit incremental
+                   history requests.  The default value is 2,000 which is
+                   I feel is low.  Increasing to around 10,000 is probably
+                   fine but beyond that experimental.
 MAX_SUBS         - maximum number of address subscriptions across all
                    sessions.  Defaults to 250,000.
 MAX_SESSION_SUBS - maximum number of address subscriptions permitted to a

server/env.py

@@ -44,7 +44,8 @@ class Env(LoggedClass):
         # The electrum client takes the empty string as unspecified
         self.donation_address = self.default('DONATION_ADDRESS', '')
         self.db_engine = self.default('DB_ENGINE', 'leveldb')
-        # Subscription limits
+        # Server limits to help prevent DoS
+        self.max_hist = self.integer('MAX_HIST', 2000)
         self.max_subs = self.integer('MAX_SUBS', 250000)
         self.max_session_subs = self.integer('MAX_SESSION_SUBS', 50000)
         # IRC

server/protocol.py

@@ -674,9 +674,11 @@ class ElectrumX(Session):
         return self.bp.read_headers(start_height, count).hex()
 
     async def async_get_history(self, hash168):
+        # Apply DoS limit
+        limit = self.env.max_hist
         # Python 3.6: use async generators; update callers
         history = []
-        for item in self.bp.get_history(hash168, limit=None):
+        for item in self.bp.get_history(hash168, limit=limit):
             history.append(item)
             if len(history) % 100 == 0:
                 await asyncio.sleep(0)