Home | History | Annotate | Download | only in racoon 
      1 /*	$NetBSD: throttle.c,v 1.7 2011/03/14 17:18:13 tteras Exp $	*/
      2 
      3 /* Id: throttle.c,v 1.5 2006/04/05 20:54:50 manubsd Exp */
      4 
      5 /*
      6  * Copyright (C) 2004 Emmanuel Dreyfus
      7  * All rights reserved.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted provided that the following conditions
     11  * are met:
     12  * 1. Redistributions of source code must retain the above copyright
     13  *    notice, this list of conditions and the following disclaimer.
     14  * 2. Redistributions in binary form must reproduce the above copyright
     15  *    notice, this list of conditions and the following disclaimer in the
     16  *    documentation and/or other materials provided with the distribution.
     17  * 3. Neither the name of the project nor the names of its contributors
     18  *    may be used to endorse or promote products derived from this software
     19  *    without specific prior written permission.
     20  *
     21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     31  * SUCH DAMAGE.
     32  */
     33 
     34 #include "config.h"
     35 
     36 #include <stdlib.h>
     37 #include <string.h>
     38 #include <sys/param.h>
     39 #include <sys/queue.h>
     40 #include <netinet/in.h>
     41 #include <resolv.h>
     42 
     43 #include "vmbuf.h"
     44 #include "misc.h"
     45 #include "plog.h"
     46 #include "throttle.h"
     47 #include "sockmisc.h"
     48 #include "isakmp_var.h"
     49 #include "isakmp.h"
     50 #include "isakmp_xauth.h"
     51 #include "isakmp_cfg.h"
     52 #include "gcmalloc.h"
     53 
     54 static struct throttle_list throttle_list =
     55 	TAILQ_HEAD_INITIALIZER(throttle_list);
     56 
     57 struct throttle_entry *
     58 throttle_add(addr)
     59 	struct sockaddr *addr;
     60 {
     61 	struct throttle_entry *te;
     62 	struct timeval now, penalty;
     63 	size_t len;
     64 
     65 	len = sizeof(*te)
     66 	    - sizeof(struct sockaddr_storage)
     67 	    + sysdep_sa_len(addr);
     68 
     69 	if ((te = racoon_malloc(len)) == NULL)
     70 		return NULL;
     71 
     72 	sched_get_monotonic_time(&now);
     73 	penalty.tv_sec = isakmp_cfg_config.auth_throttle;
     74 	penalty.tv_usec = 0;
     75 	timeradd(&now, &penalty, &te->penalty_ends);
     76 
     77 	memcpy(&te->host, addr, sysdep_sa_len(addr));
     78 	TAILQ_INSERT_HEAD(&throttle_list, te, next);
     79 
     80 	return te;
     81 }
     82 
     83 int
     84 throttle_host(addr, authfail)
     85 	struct sockaddr *addr;
     86 	int authfail;
     87 {
     88 	struct throttle_entry *te;
     89 	struct timeval now, res;
     90 	int found = 0;
     91 
     92 	if (isakmp_cfg_config.auth_throttle == 0)
     93 		return 0;
     94 
     95 	sched_get_monotonic_time(&now);
     96 restart:
     97 	RACOON_TAILQ_FOREACH_REVERSE(te, &throttle_list, throttle_list, next) {
     98 		/*
     99 		 * Remove outdated entries
    100 		 */
    101 		if (timercmp(&te->penalty_ends, &now, <)) {
    102 			TAILQ_REMOVE(&throttle_list, te, next);
    103 			racoon_free(te);
    104 			goto restart;
    105 		}
    106 
    107 		if (cmpsaddr(addr, (struct sockaddr *) &te->host) <= CMPSADDR_WOP_MATCH) {
    108 			found = 1;
    109 			break;
    110 		}
    111 	}
    112 
    113 	/*
    114 	 * No match, if auth failed, allocate a new throttle entry
    115 	 * give no penalty even on error: this is the first time
    116 	 * and we are indulgent.
    117 	 */
    118 	if (!found) {
    119 		if (authfail) {
    120 			if ((te = throttle_add(addr)) == NULL) {
    121 				plog(LLV_ERROR, LOCATION, NULL,
    122 				    "Throttle insertion failed\n");
    123 				return isakmp_cfg_config.auth_throttle;
    124 			}
    125 		}
    126 		return 0;
    127 	} else {
    128 		/*
    129 		 * We had a match and auth failed, increase penalty.
    130 		 */
    131 		if (authfail) {
    132 			struct timeval remaining, penalty;
    133 
    134 			timersub(&te->penalty_ends, &now, &remaining);
    135 			penalty.tv_sec = isakmp_cfg_config.auth_throttle;
    136 			penalty.tv_usec = 0;
    137 			timeradd(&penalty, &remaining, &res);
    138 			if (res.tv_sec >= THROTTLE_PENALTY_MAX) {
    139 				res.tv_sec = THROTTLE_PENALTY_MAX;
    140 				res.tv_usec = 0;
    141 			}
    142 			timeradd(&now, &res, &te->penalty_ends);
    143 		}
    144 	}
    145 
    146 	timersub(&te->penalty_ends, &now, &res);
    147 	return res.tv_sec;
    148 }
    149 
    150