ipsec-tools/racoon/throttle.c

   1 /*      $NetBSD: throttle.c,v 1.4 2006/09/09 16:22:10 manu Exp $        */
   2
   3 /* Id: throttle.c,v 1.5 2006/04/05 20:54:50 manubsd Exp */
   4
   5 /*
   6  * Copyright (C) 2004 Emmanuel Dreyfus
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. Neither the name of the project nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "config.h"
  35
  36 #include <stdio.h>
  37 #include <stdlib.h>
  38 #include <string.h>
  39 #if TIME_WITH_SYS_TIME
  40 # include <sys/time.h>
  41 # include <time.h>
  42 #else
  43 # if HAVE_SYS_TIME_H
  44 #  include <sys/time.h>
  45 # else
  46 #  include <time.h>
  47 # endif
  48 #endif
  49 #include <sys/param.h>
  50 #include <sys/queue.h>
  51 #include <sys/socket.h>
  52
  53 #include <netinet/in.h>
  54 #include <resolv.h>
  55
  56 #include "vmbuf.h"
  57 #include "misc.h"
  58 #include "plog.h"
  59 #include "throttle.h"
  60 #include "sockmisc.h"
  61 #include "libpfkey.h"
  62 #include "isakmp_var.h"
  63 #include "isakmp.h"
  64 #include "isakmp_xauth.h"
  65 #include "isakmp_cfg.h"
  66 #include "gcmalloc.h"
  67
  68 struct throttle_list throttle_list = TAILQ_HEAD_INITIALIZER(throttle_list);
  69
  70
  71 struct throttle_entry *
  72 throttle_add(addr)
  73         struct sockaddr *addr;
  74 {
  75         struct throttle_entry *te;
  76         size_t len;
  77
  78         len = sizeof(*te)
  79             - sizeof(struct sockaddr_storage)
  80             + sysdep_sa_len(addr);
  81
  82         if ((te = racoon_malloc(len)) == NULL)
  83                 return NULL;
  84
  85         te->penalty = time(NULL) + isakmp_cfg_config.auth_throttle;
  86         memcpy(&te->host, addr, sysdep_sa_len(addr));
  87         TAILQ_INSERT_HEAD(&throttle_list, te, next);
  88
  89         return te;
  90 }
  91
  92 int
  93 throttle_host(addr, authfail)
  94         struct sockaddr *addr;
  95         int authfail;
  96 {
  97         struct throttle_entry *te;
  98         int found = 0;
  99         time_t now;
 100
 101         if (isakmp_cfg_config.auth_throttle == 0)
 102                 return 0;
 103
 104         now = time(NULL);
 105
 106 restart:
 107         TAILQ_FOREACH_REVERSE(te, &throttle_list, throttle_list, next) {
 108           /*
 109            * Remove outdated entries
 110            */
 111                 if (te->penalty < now) {
 112                         TAILQ_REMOVE(&throttle_list, te, next);
 113                         racoon_free(te);
 114                         goto restart;
 115                 }
 116
 117                 if (cmpsaddrwop(addr, (struct sockaddr *)&te->host) == 0) {
 118                         found = 1;
 119                         break;
 120                 }
 121         }
 122
 123         /*
 124          * No match, if auth failed, allocate a new throttle entry
 125          * give no penalty even on error: this is the first time
 126          * and we are indulgent.
 127          */
 128         if (!found) {
 129                 if (authfail) {
 130                         if ((te = throttle_add(addr)) == NULL) {
 131                                 plog(LLV_ERROR, LOCATION, NULL,
 132                                     "Throttle insertion failed\n");
 133                                 return (time(NULL)
 134                                     + isakmp_cfg_config.auth_throttle);
 135                         }
 136                 }
 137                 return 0;
 138         } else {
 139                 /*
 140                  * We had a match and auth failed, increase penalty.
 141                  */
 142                 if (authfail) {
 143                         time_t remaining;
 144                         time_t new;
 145
 146                         remaining = te->penalty - now;
 147                         new = remaining + isakmp_cfg_config.auth_throttle;
 148
 149                         if (new > THROTTLE_PENALTY_MAX)
 150                                 new = THROTTLE_PENALTY_MAX;
 151
 152                         te->penalty = now + new;
 153                 }
 154         }
 155
 156         return te->penalty;
 157 }
 158