[apple/ipsec.git] / ipsec-tools / racoon / throttle.c

/*	$NetBSD: throttle.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/

/* Id: throttle.c,v 1.5 2006/04/05 20:54:50 manubsd Exp */

/*
 * Copyright (C) 2004 Emmanuel Dreyfus
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "config.h"

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#if TIME_WITH_SYS_TIME
# include <sys/time.h>
# include <time.h> 
#else 
# if HAVE_SYS_TIME_H
#  include <sys/time.h>
# else
#  include <time.h>
# endif 
#endif
#include <sys/param.h>
#include <sys/queue.h>
#include <sys/socket.h>

#include <netinet/in.h>
#include <resolv.h>

#include "vmbuf.h"
#include "misc.h"
#include "plog.h"
#include "throttle.h"
#include "sockmisc.h"
#include "libpfkey.h"
#include "isakmp_var.h"
#include "isakmp.h"
#include "isakmp_xauth.h"
#include "isakmp_cfg.h"
#include "gcmalloc.h"

struct throttle_list throttle_list = TAILQ_HEAD_INITIALIZER(throttle_list);


struct throttle_entry *
throttle_add(addr)
	struct sockaddr_storage *addr;
{
	struct throttle_entry *te;
	size_t len;

	len = sizeof(*te) 
	    - sizeof(struct sockaddr_storage) 
	    + sysdep_sa_len((struct sockaddr *)addr);

	if ((te = racoon_malloc(len)) == NULL)
		return NULL;

	te->penalty = time(NULL) + isakmp_cfg_config.auth_throttle;
	memcpy(&te->host, addr, sysdep_sa_len((struct sockaddr *)addr));
	TAILQ_INSERT_HEAD(&throttle_list, te, next);

	return te;
}

int
throttle_host(addr, authfail) 
	struct sockaddr_storage *addr;
	int authfail;
{
	struct throttle_entry *te;
	int found = 0;
	time_t now;

	if (isakmp_cfg_config.auth_throttle == 0)
		return 0;

	now = time(NULL);

restart:
	TAILQ_FOREACH_REVERSE(te, &throttle_list, throttle_list, next) {
	  /*
	   * Remove outdated entries 
	   */
		if (te->penalty < now) {
			TAILQ_REMOVE(&throttle_list, te, next);
			racoon_free(te);
			goto restart;
		}
			
		if (cmpsaddrwop(addr, (struct sockaddr_storage *)&te->host) == 0) {
			found = 1;
			break;
		}
	}

	/* 
	 * No match, if auth failed, allocate a new throttle entry
	 * give no penalty even on error: this is the first time
	 * and we are indulgent.
	 */
	if (!found) {
		if (authfail) {
			if ((te = throttle_add(addr)) == NULL) {
				plog(ASL_LEVEL_ERR, 
				    "Throttle insertion failed\n");
				return (time(NULL) 
				    + isakmp_cfg_config.auth_throttle);
			}
		}
		return 0;
	} else {
		/*
		 * We had a match and auth failed, increase penalty.
		 */
		if (authfail) {
			time_t remaining;
			time_t new;

			remaining = te->penalty - now;
			new = remaining + isakmp_cfg_config.auth_throttle;

			if (new > THROTTLE_PENALTY_MAX)
				new = THROTTLE_PENALTY_MAX;

			te->penalty = now + new;
		}
	}
	
	return te->penalty;
}
Commit	Line	Data
d1e348cf A	1	/* $NetBSD: throttle.c,v 1.4 2006/09/09 16:22:10 manu Exp $ */
	2
	3	/* Id: throttle.c,v 1.5 2006/04/05 20:54:50 manubsd Exp */
52b7d2ce A	4
	5	/*
	6	* Copyright (C) 2004 Emmanuel Dreyfus
	7	* All rights reserved.
	8	*
	9	* Redistribution and use in source and binary forms, with or without
	10	* modification, are permitted provided that the following conditions
	11	* are met:
	12	* 1. Redistributions of source code must retain the above copyright
	13	* notice, this list of conditions and the following disclaimer.
	14	* 2. Redistributions in binary form must reproduce the above copyright
	15	* notice, this list of conditions and the following disclaimer in the
	16	* documentation and/or other materials provided with the distribution.
	17	* 3. Neither the name of the project nor the names of its contributors
	18	* may be used to endorse or promote products derived from this software
	19	* without specific prior written permission.
	20	*
	21	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	22	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	23	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	24	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	25	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	26	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	27	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	28	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	29	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	30	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	31	* SUCH DAMAGE.
	32	*/
	33
	34	#include "config.h"
	35
	36	#include <stdio.h>
	37	#include <stdlib.h>
	38	#include <string.h>
	39	#if TIME_WITH_SYS_TIME
	40	# include <sys/time.h>
	41	# include <time.h>
	42	#else
	43	# if HAVE_SYS_TIME_H
	44	# include <sys/time.h>
	45	# else
	46	# include <time.h>
	47	# endif
	48	#endif
	49	#include <sys/param.h>
	50	#include <sys/queue.h>
	51	#include <sys/socket.h>
	52
	53	#include <netinet/in.h>
d1e348cf	54	#include <resolv.h>
52b7d2ce A	55
	56	#include "vmbuf.h"
	57	#include "misc.h"
	58	#include "plog.h"
	59	#include "throttle.h"
	60	#include "sockmisc.h"
	61	#include "libpfkey.h"
	62	#include "isakmp_var.h"
	63	#include "isakmp.h"
	64	#include "isakmp_xauth.h"
	65	#include "isakmp_cfg.h"
	66	#include "gcmalloc.h"
	67
	68	struct throttle_list throttle_list = TAILQ_HEAD_INITIALIZER(throttle_list);
	69
	70
	71	struct throttle_entry *
	72	throttle_add(addr)
85f41bec	73	struct sockaddr_storage *addr;
52b7d2ce A	74	{
	75	struct throttle_entry *te;
	76	size_t len;
	77
	78	len = sizeof(*te)
	79	- sizeof(struct sockaddr_storage)
85f41bec	80	+ sysdep_sa_len((struct sockaddr *)addr);
52b7d2ce A	81
	82	if ((te = racoon_malloc(len)) == NULL)
	83	return NULL;
	84
	85	te->penalty = time(NULL) + isakmp_cfg_config.auth_throttle;
85f41bec	86	memcpy(&te->host, addr, sysdep_sa_len((struct sockaddr *)addr));
52b7d2ce A	87	TAILQ_INSERT_HEAD(&throttle_list, te, next);
	88
	89	return te;
	90	}
	91
	92	int
	93	throttle_host(addr, authfail)
85f41bec	94	struct sockaddr_storage *addr;
52b7d2ce A	95	int authfail;
	96	{
	97	struct throttle_entry *te;
	98	int found = 0;
	99	time_t now;
	100
	101	if (isakmp_cfg_config.auth_throttle == 0)
	102	return 0;
	103
	104	now = time(NULL);
	105
d1e348cf	106	restart:
52b7d2ce	107	TAILQ_FOREACH_REVERSE(te, &throttle_list, throttle_list, next) {
d1e348cf A	108	/*
	109	* Remove outdated entries
	110	*/
52b7d2ce A	111	if (te->penalty < now) {
	112	TAILQ_REMOVE(&throttle_list, te, next);
	113	racoon_free(te);
d1e348cf	114	goto restart;
52b7d2ce A	115	}
52b7d2ce A	116
85f41bec	117	if (cmpsaddrwop(addr, (struct sockaddr_storage *)&te->host) == 0) {
52b7d2ce A	118	found = 1;
	119	break;
	120	}
	121	}
	122
	123	/*
	124	* No match, if auth failed, allocate a new throttle entry
	125	* give no penalty even on error: this is the first time
	126	* and we are indulgent.
	127	*/
	128	if (!found) {
	129	if (authfail) {
	130	if ((te = throttle_add(addr)) == NULL) {
65c25746	131	plog(ASL_LEVEL_ERR,
52b7d2ce A	132	"Throttle insertion failed\n");
	133	return (time(NULL)
	134	+ isakmp_cfg_config.auth_throttle);
	135	}
	136	}
	137	return 0;
	138	} else {
	139	/*
	140	* We had a match and auth failed, increase penalty.
	141	*/
	142	if (authfail) {
	143	time_t remaining;
	144	time_t new;
	145
	146	remaining = te->penalty - now;
	147	new = remaining + isakmp_cfg_config.auth_throttle;
	148
	149	if (new > THROTTLE_PENALTY_MAX)
	150	new = THROTTLE_PENALTY_MAX;
	151
	152	te->penalty = now + new;
	153	}
	154	}
	155
	156	return te->penalty;
	157	}
	158