Home | History | Annotate | Line # | Download | only in racoon 
      1 /*	$NetBSD: throttle.c,v 1.8 2025/03/07 15:55:30 christos Exp $	*/
      2 
      3 /* Id: throttle.c,v 1.5 2006/04/05 20:54:50 manubsd Exp */
      4 
      5 /*
      6  * Copyright (C) 2004 Emmanuel Dreyfus
      7  * All rights reserved.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted provided that the following conditions
     11  * are met:
     12  * 1. Redistributions of source code must retain the above copyright
     13  *    notice, this list of conditions and the following disclaimer.
     14  * 2. Redistributions in binary form must reproduce the above copyright
     15  *    notice, this list of conditions and the following disclaimer in the
     16  *    documentation and/or other materials provided with the distribution.
     17  * 3. Neither the name of the project nor the names of its contributors
     18  *    may be used to endorse or promote products derived from this software
     19  *    without specific prior written permission.
     20  *
     21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     31  * SUCH DAMAGE.
     32  */
     33 
     34 #include "config.h"
     35 
     36 #include <stdlib.h>
     37 #include <string.h>
     38 #include <sys/param.h>
     39 #include <sys/queue.h>
     40 #include <netinet/in.h>
     41 #include <resolv.h>
     42 
     43 #include "vmbuf.h"
     44 #include "misc.h"
     45 #include "plog.h"
     46 #include "throttle.h"
     47 #include "sockmisc.h"
     48 #include "isakmp_var.h"
     49 #include "isakmp.h"
     50 #include "isakmp_xauth.h"
     51 #include "isakmp_cfg.h"
     52 #include "gcmalloc.h"
     53 
     54 static struct throttle_list throttle_list =
     55 	TAILQ_HEAD_INITIALIZER(throttle_list);
     56 
     57 struct throttle_entry *
     58 throttle_add(struct sockaddr *addr)
     59 {
     60 	struct throttle_entry *te;
     61 	struct timeval now, penalty;
     62 	size_t len;
     63 
     64 	len = sizeof(*te)
     65 	    - sizeof(struct sockaddr_storage)
     66 	    + sysdep_sa_len(addr);
     67 
     68 	if ((te = racoon_malloc(len)) == NULL)
     69 		return NULL;
     70 
     71 	sched_get_monotonic_time(&now);
     72 	penalty.tv_sec = isakmp_cfg_config.auth_throttle;
     73 	penalty.tv_usec = 0;
     74 	timeradd(&now, &penalty, &te->penalty_ends);
     75 
     76 	memcpy(&te->host, addr, sysdep_sa_len(addr));
     77 	TAILQ_INSERT_HEAD(&throttle_list, te, next);
     78 
     79 	return te;
     80 }
     81 
     82 int
     83 throttle_host(struct sockaddr *addr, int authfail)
     84 {
     85 	struct throttle_entry *te;
     86 	struct timeval now, res;
     87 	int found = 0;
     88 
     89 	if (isakmp_cfg_config.auth_throttle == 0)
     90 		return 0;
     91 
     92 	sched_get_monotonic_time(&now);
     93 restart:
     94 	RACOON_TAILQ_FOREACH_REVERSE(te, &throttle_list, throttle_list, next) {
     95 		/*
     96 		 * Remove outdated entries
     97 		 */
     98 		if (timercmp(&te->penalty_ends, &now, <)) {
     99 			TAILQ_REMOVE(&throttle_list, te, next);
    100 			racoon_free(te);
    101 			goto restart;
    102 		}
    103 
    104 		if (cmpsaddr(addr, (struct sockaddr *) &te->host) <= CMPSADDR_WOP_MATCH) {
    105 			found = 1;
    106 			break;
    107 		}
    108 	}
    109 
    110 	/*
    111 	 * No match, if auth failed, allocate a new throttle entry
    112 	 * give no penalty even on error: this is the first time
    113 	 * and we are indulgent.
    114 	 */
    115 	if (!found) {
    116 		if (authfail) {
    117 			if ((te = throttle_add(addr)) == NULL) {
    118 				plog(LLV_ERROR, LOCATION, NULL,
    119 				    "Throttle insertion failed\n");
    120 				return isakmp_cfg_config.auth_throttle;
    121 			}
    122 		}
    123 		return 0;
    124 	} else {
    125 		/*
    126 		 * We had a match and auth failed, increase penalty.
    127 		 */
    128 		if (authfail) {
    129 			struct timeval remaining, penalty;
    130 
    131 			timersub(&te->penalty_ends, &now, &remaining);
    132 			penalty.tv_sec = isakmp_cfg_config.auth_throttle;
    133 			penalty.tv_usec = 0;
    134 			timeradd(&penalty, &remaining, &res);
    135 			if (res.tv_sec >= THROTTLE_PENALTY_MAX) {
    136 				res.tv_sec = THROTTLE_PENALTY_MAX;
    137 				res.tv_usec = 0;
    138 			}
    139 			timeradd(&now, &res, &te->penalty_ends);
    140 		}
    141 	}
    142 
    143 	timersub(&te->penalty_ends, &now, &res);
    144 	return res.tv_sec;
    145 }
    146 
    147