throttle.c revision 0a1907d434839af6a9cb6329bbde60b237bf53dc 
1/*	$NetBSD: throttle.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
2
3/* Id: throttle.c,v 1.5 2006/04/05 20:54:50 manubsd Exp */
4
5/*
6 * Copyright (C) 2004 Emmanuel Dreyfus
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 *    notice, this list of conditions and the following disclaimer in the
16 *    documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "config.h"
35
36#include <stdio.h>
37#include <stdlib.h>
38#include <string.h>
39#if TIME_WITH_SYS_TIME
40# include <sys/time.h>
41# include <time.h>
42#else
43# if HAVE_SYS_TIME_H
44#  include <sys/time.h>
45# else
46#  include <time.h>
47# endif
48#endif
49#include <sys/param.h>
50#include <sys/queue.h>
51#include <sys/socket.h>
52
53#include <netinet/in.h>
54#include <resolv.h>
55
56#include "vmbuf.h"
57#include "misc.h"
58#include "plog.h"
59#include "throttle.h"
60#include "sockmisc.h"
61#include "libpfkey.h"
62#include "isakmp_var.h"
63#include "isakmp.h"
64#include "isakmp_xauth.h"
65#include "isakmp_cfg.h"
66#include "gcmalloc.h"
67
68struct throttle_list throttle_list = TAILQ_HEAD_INITIALIZER(throttle_list);
69
70
71struct throttle_entry *
72throttle_add(addr)
73	struct sockaddr *addr;
74{
75	struct throttle_entry *te;
76	size_t len;
77
78	len = sizeof(*te)
79	    - sizeof(struct sockaddr_storage)
80	    + sysdep_sa_len(addr);
81
82	if ((te = racoon_malloc(len)) == NULL)
83		return NULL;
84
85	te->penalty = time(NULL) + isakmp_cfg_config.auth_throttle;
86	memcpy(&te->host, addr, sysdep_sa_len(addr));
87	TAILQ_INSERT_HEAD(&throttle_list, te, next);
88
89	return te;
90}
91
92int
93throttle_host(addr, authfail)
94	struct sockaddr *addr;
95	int authfail;
96{
97	struct throttle_entry *te;
98	int found = 0;
99	time_t now;
100
101	if (isakmp_cfg_config.auth_throttle == 0)
102		return 0;
103
104	now = time(NULL);
105
106restart:
107	RACOON_TAILQ_FOREACH_REVERSE(te, &throttle_list, throttle_list, next) {
108	  /*
109	   * Remove outdated entries
110	   */
111		if (te->penalty < now) {
112			TAILQ_REMOVE(&throttle_list, te, next);
113			racoon_free(te);
114			goto restart;
115		}
116
117		if (cmpsaddrwop(addr, (struct sockaddr *)&te->host) == 0) {
118			found = 1;
119			break;
120		}
121	}
122
123	/*
124	 * No match, if auth failed, allocate a new throttle entry
125	 * give no penalty even on error: this is the first time
126	 * and we are indulgent.
127	 */
128	if (!found) {
129		if (authfail) {
130			if ((te = throttle_add(addr)) == NULL) {
131				plog(LLV_ERROR, LOCATION, NULL,
132				    "Throttle insertion failed\n");
133				return (time(NULL)
134				    + isakmp_cfg_config.auth_throttle);
135			}
136		}
137		return 0;
138	} else {
139		/*
140		 * We had a match and auth failed, increase penalty.
141		 */
142		if (authfail) {
143			time_t remaining;
144			time_t new;
145
146			remaining = te->penalty - now;
147			new = remaining + isakmp_cfg_config.auth_throttle;
148
149			if (new > THROTTLE_PENALTY_MAX)
150				new = THROTTLE_PENALTY_MAX;
151
152			te->penalty = now + new;
153		}
154	}
155
156	return te->penalty;
157}
158
159