Return to throttle.c CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / racoon

Annotation of embedaddon/ipsec-tools/src/racoon/throttle.c, revision 1.1

1.1     ! misho       1: /*     $NetBSD: throttle.c,v 1.7 2011/03/14 17:18:13 tteras Exp $      */
        !             2: 
        !             3: /* Id: throttle.c,v 1.5 2006/04/05 20:54:50 manubsd Exp */
        !             4: 
        !             5: /*
        !             6:  * Copyright (C) 2004 Emmanuel Dreyfus
        !             7:  * All rights reserved.
        !             8:  * 
        !             9:  * Redistribution and use in source and binary forms, with or without
        !            10:  * modification, are permitted provided that the following conditions
        !            11:  * are met:
        !            12:  * 1. Redistributions of source code must retain the above copyright
        !            13:  *    notice, this list of conditions and the following disclaimer.
        !            14:  * 2. Redistributions in binary form must reproduce the above copyright
        !            15:  *    notice, this list of conditions and the following disclaimer in the
        !            16:  *    documentation and/or other materials provided with the distribution.
        !            17:  * 3. Neither the name of the project nor the names of its contributors
        !            18:  *    may be used to endorse or promote products derived from this software
        !            19:  *    without specific prior written permission.
        !            20:  * 
        !            21:  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
        !            22:  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
        !            23:  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
        !            24:  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
        !            25:  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
        !            26:  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
        !            27:  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
        !            28:  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
        !            29:  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
        !            30:  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
        !            31:  * SUCH DAMAGE.
        !            32:  */
        !            33: 
        !            34: #include "config.h"
        !            35: 
        !            36: #include <stdlib.h>
        !            37: #include <string.h>
        !            38: #include <sys/param.h>
        !            39: #include <sys/queue.h>
        !            40: #include <netinet/in.h>
        !            41: #include <resolv.h>
        !            42: 
        !            43: #include "vmbuf.h"
        !            44: #include "misc.h"
        !            45: #include "plog.h"
        !            46: #include "throttle.h"
        !            47: #include "sockmisc.h"
        !            48: #include "isakmp_var.h"
        !            49: #include "isakmp.h"
        !            50: #include "isakmp_xauth.h"
        !            51: #include "isakmp_cfg.h"
        !            52: #include "gcmalloc.h"
        !            53: 
        !            54: static struct throttle_list throttle_list =
        !            55:        TAILQ_HEAD_INITIALIZER(throttle_list);
        !            56: 
        !            57: struct throttle_entry *
        !            58: throttle_add(addr)
        !            59:        struct sockaddr *addr;
        !            60: {
        !            61:        struct throttle_entry *te;
        !            62:        struct timeval now, penalty;
        !            63:        size_t len;
        !            64: 
        !            65:        len = sizeof(*te) 
        !            66:            - sizeof(struct sockaddr_storage) 
        !            67:            + sysdep_sa_len(addr);
        !            68: 
        !            69:        if ((te = racoon_malloc(len)) == NULL)
        !            70:                return NULL;
        !            71: 
        !            72:        sched_get_monotonic_time(&now);
        !            73:        penalty.tv_sec = isakmp_cfg_config.auth_throttle;
        !            74:        penalty.tv_usec = 0;
        !            75:        timeradd(&now, &penalty, &te->penalty_ends);
        !            76: 
        !            77:        memcpy(&te->host, addr, sysdep_sa_len(addr));
        !            78:        TAILQ_INSERT_HEAD(&throttle_list, te, next);
        !            79: 
        !            80:        return te;
        !            81: }
        !            82: 
        !            83: int
        !            84: throttle_host(addr, authfail) 
        !            85:        struct sockaddr *addr;
        !            86:        int authfail;
        !            87: {
        !            88:        struct throttle_entry *te;
        !            89:        struct timeval now, res;
        !            90:        int found = 0;
        !            91: 
        !            92:        if (isakmp_cfg_config.auth_throttle == 0)
        !            93:                return 0;
        !            94: 
        !            95:        sched_get_monotonic_time(&now);
        !            96: restart:
        !            97:        RACOON_TAILQ_FOREACH_REVERSE(te, &throttle_list, throttle_list, next) {
        !            98:                /*
        !            99:                 * Remove outdated entries
        !           100:                 */
        !           101:                if (timercmp(&te->penalty_ends, &now, <)) {
        !           102:                        TAILQ_REMOVE(&throttle_list, te, next);
        !           103:                        racoon_free(te);
        !           104:                        goto restart;
        !           105:                }
        !           106: 
        !           107:                if (cmpsaddr(addr, (struct sockaddr *) &te->host) <= CMPSADDR_WOP_MATCH) {
        !           108:                        found = 1;
        !           109:                        break;
        !           110:                }
        !           111:        }
        !           112: 
        !           113:        /* 
        !           114:         * No match, if auth failed, allocate a new throttle entry
        !           115:         * give no penalty even on error: this is the first time
        !           116:         * and we are indulgent.
        !           117:         */
        !           118:        if (!found) {
        !           119:                if (authfail) {
        !           120:                        if ((te = throttle_add(addr)) == NULL) {
        !           121:                                plog(LLV_ERROR, LOCATION, NULL, 
        !           122:                                    "Throttle insertion failed\n");
        !           123:                                return isakmp_cfg_config.auth_throttle;
        !           124:                        }
        !           125:                }
        !           126:                return 0;
        !           127:        } else {
        !           128:                /*
        !           129:                 * We had a match and auth failed, increase penalty.
        !           130:                 */
        !           131:                if (authfail) {
        !           132:                        struct timeval remaining, penalty;
        !           133: 
        !           134:                        timersub(&te->penalty_ends, &now, &remaining);
        !           135:                        penalty.tv_sec = isakmp_cfg_config.auth_throttle;
        !           136:                        penalty.tv_usec = 0;
        !           137:                        timeradd(&penalty, &remaining, &res);
        !           138:                        if (res.tv_sec >= THROTTLE_PENALTY_MAX) {
        !           139:                                res.tv_sec = THROTTLE_PENALTY_MAX;
        !           140:                                res.tv_usec = 0;
        !           141:                        }
        !           142:                        timeradd(&now, &res, &te->penalty_ends);
        !           143:                }
        !           144:        }
        !           145: 
        !           146:        timersub(&te->penalty_ends, &now, &res);
        !           147:        return res.tv_sec;
        !           148: }
        !           149: