1 /* $NetBSD: throttle.c,v 1.2 2005/08/20 00:57:06 manu Exp $ */ 2 3 /* Id: throttle.c,v 1.2 2004/11/30 07:40:13 manubsd Exp */ 4 5 /* 6 * Copyright (C) 2004 Emmanuel Dreyfus 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include "config.h" 35 36 #include <stdio.h> 37 #include <stdlib.h> 38 #include <string.h> 39 #if TIME_WITH_SYS_TIME 40 # include <sys/time.h> 41 # include <time.h> 42 #else 43 # if HAVE_SYS_TIME_H 44 # include <sys/time.h> 45 # else 46 # include <time.h> 47 # endif 48 #endif 49 #include <sys/param.h> 50 #include <sys/queue.h> 51 #include <sys/socket.h> 52 53 #include <netinet/in.h> 54 55 #include "vmbuf.h" 56 #include "misc.h" 57 #include "plog.h" 58 #include "throttle.h" 59 #include "sockmisc.h" 60 #include "libpfkey.h" 61 #include "isakmp_var.h" 62 #include "isakmp.h" 63 #include "isakmp_xauth.h" 64 #include "isakmp_cfg.h" 65 #include "gcmalloc.h" 66 67 struct throttle_list throttle_list = TAILQ_HEAD_INITIALIZER(throttle_list); 68 69 70 struct throttle_entry * 71 throttle_add(addr) 72 struct sockaddr *addr; 73 { 74 struct throttle_entry *te; 75 size_t len; 76 77 len = sizeof(*te) 78 - sizeof(struct sockaddr_storage) 79 + sysdep_sa_len(addr); 80 81 if ((te = racoon_malloc(len)) == NULL) 82 return NULL; 83 84 te->penalty = time(NULL) + isakmp_cfg_config.auth_throttle; 85 memcpy(&te->host, addr, sysdep_sa_len(addr)); 86 TAILQ_INSERT_HEAD(&throttle_list, te, next); 87 88 return te; 89 } 90 91 int 92 throttle_host(addr, authfail) 93 struct sockaddr *addr; 94 int authfail; 95 { 96 struct throttle_entry *te; 97 int found = 0; 98 time_t now; 99 100 if (isakmp_cfg_config.auth_throttle == 0) 101 return 0; 102 103 now = time(NULL); 104 105 TAILQ_FOREACH_REVERSE(te, &throttle_list, throttle_list, next) { 106 /* 107 * Remove outdated entries 108 */ 109 if (te->penalty < now) { 110 TAILQ_REMOVE(&throttle_list, te, next); 111 racoon_free(te); 112 continue; 113 } 114 115 if (cmpsaddrwop(addr, (struct sockaddr *)&te->host) == 0) { 116 found = 1; 117 break; 118 } 119 } 120 121 /* 122 * No match, if auth failed, allocate a new throttle entry 123 * give no penalty even on error: this is the first time 124 * and we are indulgent. 125 */ 126 if (!found) { 127 if (authfail) { 128 if ((te = throttle_add(addr)) == NULL) { 129 plog(LLV_ERROR, LOCATION, NULL, 130 "Throttle insertion failed\n"); 131 return (time(NULL) 132 + isakmp_cfg_config.auth_throttle); 133 } 134 } 135 return 0; 136 } else { 137 /* 138 * We had a match and auth failed, increase penalty. 139 */ 140 if (authfail) { 141 time_t remaining; 142 time_t new; 143 144 remaining = te->penalty - now; 145 new = remaining + isakmp_cfg_config.auth_throttle; 146 147 if (new > THROTTLE_PENALTY_MAX) 148 new = THROTTLE_PENALTY_MAX; 149 150 te->penalty = now + new; 151 } 152 } 153 154 return te->penalty; 155 } 156 157