1 /* $NetBSD: throttle.c,v 1.4 2006/09/09 16:22:10 manu Exp $ */
2
3 /* Id: throttle.c,v 1.5 2006/04/05 20:54:50 manubsd Exp */
4
5 /*
6 * Copyright (C) 2004 Emmanuel Dreyfus
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include "config.h"
35
36 #include <stdio.h>
37 #include <stdlib.h>
38 #include <string.h>
39 #if TIME_WITH_SYS_TIME
40 # include <sys/time.h>
41 # include <time.h>
42 #else
43 # if HAVE_SYS_TIME_H
44 # include <sys/time.h>
45 # else
46 # include <time.h>
47 # endif
48 #endif
49 #include <sys/param.h>
50 #include <sys/queue.h>
51 #include <sys/socket.h>
52
53 #include <netinet/in.h>
54 #include <resolv.h>
55
56 #include "vmbuf.h"
57 #include "misc.h"
58 #include "plog.h"
59 #include "throttle.h"
60 #include "sockmisc.h"
61 #include "libpfkey.h"
62 #include "isakmp_var.h"
63 #include "isakmp.h"
64 #include "isakmp_xauth.h"
65 #include "isakmp_cfg.h"
66 #include "gcmalloc.h"
67
68 struct throttle_list throttle_list = TAILQ_HEAD_INITIALIZER(throttle_list);
69
70
71 struct throttle_entry *
throttle_add(addr)72 throttle_add(addr)
73 struct sockaddr *addr;
74 {
75 struct throttle_entry *te;
76 size_t len;
77
78 len = sizeof(*te)
79 - sizeof(struct sockaddr_storage)
80 + sysdep_sa_len(addr);
81
82 if ((te = racoon_malloc(len)) == NULL)
83 return NULL;
84
85 te->penalty = time(NULL) + isakmp_cfg_config.auth_throttle;
86 memcpy(&te->host, addr, sysdep_sa_len(addr));
87 TAILQ_INSERT_HEAD(&throttle_list, te, next);
88
89 return te;
90 }
91
92 int
throttle_host(addr,authfail)93 throttle_host(addr, authfail)
94 struct sockaddr *addr;
95 int authfail;
96 {
97 struct throttle_entry *te;
98 int found = 0;
99 time_t now;
100
101 if (isakmp_cfg_config.auth_throttle == 0)
102 return 0;
103
104 now = time(NULL);
105
106 restart:
107 RACOON_TAILQ_FOREACH_REVERSE(te, &throttle_list, throttle_list, next) {
108 /*
109 * Remove outdated entries
110 */
111 if (te->penalty < now) {
112 TAILQ_REMOVE(&throttle_list, te, next);
113 racoon_free(te);
114 goto restart;
115 }
116
117 if (cmpsaddrwop(addr, (struct sockaddr *)&te->host) == 0) {
118 found = 1;
119 break;
120 }
121 }
122
123 /*
124 * No match, if auth failed, allocate a new throttle entry
125 * give no penalty even on error: this is the first time
126 * and we are indulgent.
127 */
128 if (!found) {
129 if (authfail) {
130 if ((te = throttle_add(addr)) == NULL) {
131 plog(LLV_ERROR, LOCATION, NULL,
132 "Throttle insertion failed\n");
133 return (time(NULL)
134 + isakmp_cfg_config.auth_throttle);
135 }
136 }
137 return 0;
138 } else {
139 /*
140 * We had a match and auth failed, increase penalty.
141 */
142 if (authfail) {
143 time_t remaining;
144 time_t new;
145
146 remaining = te->penalty - now;
147 new = remaining + isakmp_cfg_config.auth_throttle;
148
149 if (new > THROTTLE_PENALTY_MAX)
150 new = THROTTLE_PENALTY_MAX;
151
152 te->penalty = now + new;
153 }
154 }
155
156 return te->penalty;
157 }
158
159