Home | History | Annotate | Download | only in racoon 
      1 /*	$NetBSD: throttle.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
      2 
      3 /* Id: throttle.c,v 1.5 2006/04/05 20:54:50 manubsd Exp */
      4 
      5 /*
      6  * Copyright (C) 2004 Emmanuel Dreyfus
      7  * All rights reserved.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted provided that the following conditions
     11  * are met:
     12  * 1. Redistributions of source code must retain the above copyright
     13  *    notice, this list of conditions and the following disclaimer.
     14  * 2. Redistributions in binary form must reproduce the above copyright
     15  *    notice, this list of conditions and the following disclaimer in the
     16  *    documentation and/or other materials provided with the distribution.
     17  * 3. Neither the name of the project nor the names of its contributors
     18  *    may be used to endorse or promote products derived from this software
     19  *    without specific prior written permission.
     20  *
     21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     31  * SUCH DAMAGE.
     32  */
     33 
     34 #include "config.h"
     35 
     36 #include <stdio.h>
     37 #include <stdlib.h>
     38 #include <string.h>
     39 #if TIME_WITH_SYS_TIME
     40 # include <sys/time.h>
     41 # include <time.h>
     42 #else
     43 # if HAVE_SYS_TIME_H
     44 #  include <sys/time.h>
     45 # else
     46 #  include <time.h>
     47 # endif
     48 #endif
     49 #include <sys/param.h>
     50 #include <sys/queue.h>
     51 #include <sys/socket.h>
     52 
     53 #include <netinet/in.h>
     54 #include <resolv.h>
     55 
     56 #include "vmbuf.h"
     57 #include "misc.h"
     58 #include "plog.h"
     59 #include "throttle.h"
     60 #include "sockmisc.h"
     61 #include "libpfkey.h"
     62 #include "isakmp_var.h"
     63 #include "isakmp.h"
     64 #include "isakmp_xauth.h"
     65 #include "isakmp_cfg.h"
     66 #include "gcmalloc.h"
     67 
     68 struct throttle_list throttle_list = TAILQ_HEAD_INITIALIZER(throttle_list);
     69 
     70 
     71 struct throttle_entry *
     72 throttle_add(addr)
     73 	struct sockaddr *addr;
     74 {
     75 	struct throttle_entry *te;
     76 	size_t len;
     77 
     78 	len = sizeof(*te)
     79 	    - sizeof(struct sockaddr_storage)
     80 	    + sysdep_sa_len(addr);
     81 
     82 	if ((te = racoon_malloc(len)) == NULL)
     83 		return NULL;
     84 
     85 	te->penalty = time(NULL) + isakmp_cfg_config.auth_throttle;
     86 	memcpy(&te->host, addr, sysdep_sa_len(addr));
     87 	TAILQ_INSERT_HEAD(&throttle_list, te, next);
     88 
     89 	return te;
     90 }
     91 
     92 int
     93 throttle_host(addr, authfail)
     94 	struct sockaddr *addr;
     95 	int authfail;
     96 {
     97 	struct throttle_entry *te;
     98 	int found = 0;
     99 	time_t now;
    100 
    101 	if (isakmp_cfg_config.auth_throttle == 0)
    102 		return 0;
    103 
    104 	now = time(NULL);
    105 
    106 restart:
    107 	RACOON_TAILQ_FOREACH_REVERSE(te, &throttle_list, throttle_list, next) {
    108 	  /*
    109 	   * Remove outdated entries
    110 	   */
    111 		if (te->penalty < now) {
    112 			TAILQ_REMOVE(&throttle_list, te, next);
    113 			racoon_free(te);
    114 			goto restart;
    115 		}
    116 
    117 		if (cmpsaddrwop(addr, (struct sockaddr *)&te->host) == 0) {
    118 			found = 1;
    119 			break;
    120 		}
    121 	}
    122 
    123 	/*
    124 	 * No match, if auth failed, allocate a new throttle entry
    125 	 * give no penalty even on error: this is the first time
    126 	 * and we are indulgent.
    127 	 */
    128 	if (!found) {
    129 		if (authfail) {
    130 			if ((te = throttle_add(addr)) == NULL) {
    131 				plog(LLV_ERROR, LOCATION, NULL,
    132 				    "Throttle insertion failed\n");
    133 				return (time(NULL)
    134 				    + isakmp_cfg_config.auth_throttle);
    135 			}
    136 		}
    137 		return 0;
    138 	} else {
    139 		/*
    140 		 * We had a match and auth failed, increase penalty.
    141 		 */
    142 		if (authfail) {
    143 			time_t remaining;
    144 			time_t new;
    145 
    146 			remaining = te->penalty - now;
    147 			new = remaining + isakmp_cfg_config.auth_throttle;
    148 
    149 			if (new > THROTTLE_PENALTY_MAX)
    150 				new = THROTTLE_PENALTY_MAX;
    151 
    152 			te->penalty = now + new;
    153 		}
    154 	}
    155 
    156 	return te->penalty;
    157 }
    158 
    159