/* $NetBSD: throttle.c,v 1.4 2006/09/09 16:22:10 manu Exp $ */ /* Id: throttle.c,v 1.5 2006/04/05 20:54:50 manubsd Exp */ /* * Copyright (C) 2004 Emmanuel Dreyfus * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. Neither the name of the project nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #include "config.h" #include <stdio.h> #include <stdlib.h> #include <string.h> #if TIME_WITH_SYS_TIME # include <sys/time.h> # include <time.h> #else # if HAVE_SYS_TIME_H # include <sys/time.h> # else # include <time.h> # endif #endif #include <sys/param.h> #include <sys/queue.h> #include <sys/socket.h> #include <netinet/in.h> #include <resolv.h> #include "vmbuf.h" #include "misc.h" #include "plog.h" #include "throttle.h" #include "sockmisc.h" #include "libpfkey.h" #include "isakmp_var.h" #include "isakmp.h" #include "isakmp_xauth.h" #include "isakmp_cfg.h" #include "gcmalloc.h" struct throttle_list throttle_list = TAILQ_HEAD_INITIALIZER(throttle_list); struct throttle_entry * throttle_add(addr) struct sockaddr *addr; { struct throttle_entry *te; size_t len; len = sizeof(*te) - sizeof(struct sockaddr_storage) + sysdep_sa_len(addr); if ((te = racoon_malloc(len)) == NULL) return NULL; te->penalty = time(NULL) + isakmp_cfg_config.auth_throttle; memcpy(&te->host, addr, sysdep_sa_len(addr)); TAILQ_INSERT_HEAD(&throttle_list, te, next); return te; } int throttle_host(addr, authfail) struct sockaddr *addr; int authfail; { struct throttle_entry *te; int found = 0; time_t now; if (isakmp_cfg_config.auth_throttle == 0) return 0; now = time(NULL); restart: RACOON_TAILQ_FOREACH_REVERSE(te, &throttle_list, throttle_list, next) { /* * Remove outdated entries */ if (te->penalty < now) { TAILQ_REMOVE(&throttle_list, te, next); racoon_free(te); goto restart; } if (cmpsaddrwop(addr, (struct sockaddr *)&te->host) == 0) { found = 1; break; } } /* * No match, if auth failed, allocate a new throttle entry * give no penalty even on error: this is the first time * and we are indulgent. */ if (!found) { if (authfail) { if ((te = throttle_add(addr)) == NULL) { plog(LLV_ERROR, LOCATION, NULL, "Throttle insertion failed\n"); return (time(NULL) + isakmp_cfg_config.auth_throttle); } } return 0; } else { /* * We had a match and auth failed, increase penalty. */ if (authfail) { time_t remaining; time_t new; remaining = te->penalty - now; new = remaining + isakmp_cfg_config.auth_throttle; if (new > THROTTLE_PENALTY_MAX) new = THROTTLE_PENALTY_MAX; te->penalty = now + new; } } return te->penalty; }