diff --git a/doc/reference.conf b/doc/reference.conf index 4d544805..0b64947b 100755 --- a/doc/reference.conf +++ b/doc/reference.conf @@ -1153,10 +1153,14 @@ general { /* reject duration: the amount of time to cache the rejection */ reject_duration = 5 minutes; - /* max_unknown_ip: maximum number of pending connections to the server - * that are allowed per IP address + /* throttle_duration: Amount of time that throttling will be applied to an IP + * address. */ - max_unknown_ip = 2; + throttle_duration = 60; + + /* throttle_count: Number of connections within throttle_duration that it takes + * for throttling to take effect */ + throttle_count = 4; }; modules { diff --git a/extensions/m_webirc.c b/extensions/m_webirc.c index 735be1ed..584de673 100644 --- a/extensions/m_webirc.c +++ b/extensions/m_webirc.c @@ -125,7 +125,6 @@ mr_webirc(struct Client *client_p, struct Client *source_p, int parc, const char else rb_strlcpy(source_p->host, source_p->sockhost, sizeof(source_p->host)); - del_unknown_ip(source_p); rb_inet_pton_sock(parv[4], (struct sockaddr *)&source_p->localClient->ip); /* Check dlines now, klines will be checked on registration */ diff --git a/include/reject.h b/include/reject.h index 2a36f9a3..0f559bc1 100644 --- a/include/reject.h +++ b/include/reject.h @@ -3,7 +3,7 @@ * reject.h: header to a file which rejects users with prejudice * * Copyright (C) 2003 Aaron Sethman - * Copyright (C) 2003-2004 ircd-ratbox development team + * Copyright (C) 2003-2005 ircd-ratbox development team * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -17,11 +17,11 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 * USA * * - * $Id: reject.h 3446 2007-05-14 22:21:16Z jilles $ + * $Id: reject.h 25056 2008-02-06 20:47:40Z androsyn $ */ #ifndef INCLUDED_reject_h #define INCLUDED_reject_h @@ -29,17 +29,16 @@ /* amount of time to delay a rejected clients exit */ #define DELAYED_EXIT_TIME 10 -extern rb_dlink_list delay_exit; - void init_reject(void); -int check_reject(struct Client *); +int check_reject(rb_fde_t *F, struct sockaddr *addr); void add_reject(struct Client *, const char *mask1, const char *mask2); void flush_reject(void); int remove_reject_ip(const char *ip); int remove_reject_mask(const char *mask1, const char *mask2); +unsigned long delay_exit_length(void); + +int throttle_add(struct sockaddr *addr); -int add_unknown_ip(struct Client *client_p); -void del_unknown_ip(struct Client *client_p); #endif diff --git a/include/s_conf.h b/include/s_conf.h index 8ce8f01d..5e6834f3 100644 --- a/include/s_conf.h +++ b/include/s_conf.h @@ -210,12 +210,13 @@ struct config_file_entry int reject_ban_time; int reject_after_count; int reject_duration; + int throttle_count; + int throttle_duration; int target_change; int collision_fnc; int default_umodes; int global_snotices; int operspy_dont_care_user_info; - int max_unknown_ip; }; struct config_channel_entry diff --git a/modules/m_info.c b/modules/m_info.c index 870fe121..03671b43 100644 --- a/modules/m_info.c +++ b/modules/m_info.c @@ -446,6 +446,18 @@ static struct InfoStruct info_table[] = { &ConfigFileEntry.stats_y_oper_only, "STATS Y is only shown to operators", }, + { + "throttle_count", + OUTPUT_DECIMAL, + &ConfigFileEntry.throttle_count, + "Connection throttle threshold", + }, + { + "throttle_duration", + OUTPUT_DECIMAL, + &ConfigFileEntry.throttle_duration, + "Connection throttle duration", + }, { "tkline_expire_notices", OUTPUT_BOOLEAN, diff --git a/modules/m_stats.c b/modules/m_stats.c index 92fc3f24..b5738a74 100644 --- a/modules/m_stats.c +++ b/modules/m_stats.c @@ -875,7 +875,7 @@ stats_tstats (struct Client *source_p) "T :accepts %u refused %u", sp.is_ac, sp.is_ref); sendto_one_numeric(source_p, RPL_STATSDEBUG, "T :rejected %u delaying %lu", - sp.is_rej, rb_dlink_list_length(&delay_exit)); + sp.is_rej, delay_exit_length()); sendto_one_numeric(source_p, RPL_STATSDEBUG, "T :nicks being delayed %lu", get_nd_count()); diff --git a/src/client.c b/src/client.c index a1fd820f..8e8dd681 100644 --- a/src/client.c +++ b/src/client.c @@ -1280,7 +1280,6 @@ exit_unknown_client(struct Client *client_p, struct Client *source_p, struct Cli delete_resolver_queries(source_p->localClient->dnsquery); rb_free(source_p->localClient->dnsquery); } - del_unknown_ip(source_p); rb_dlinkDelete(&source_p->localClient->tnode, &unknown_list); if(!IsIOError(source_p)) diff --git a/src/listener.c b/src/listener.c index b5e7869e..0849ab63 100644 --- a/src/listener.c +++ b/src/listener.c @@ -438,7 +438,6 @@ static void add_connection(struct Listener *listener, rb_fde_t *F, struct sockaddr *sai, void *ssl_ctl) { struct Client *new_client; - struct ConfItem *aconf; s_assert(NULL != listener); /* @@ -468,19 +467,11 @@ add_connection(struct Listener *listener, rb_fde_t *F, struct sockaddr *sai, voi ++listener->ref_count; - /* XXX these should be done in accept_precallback */ - aconf = find_dline(sai, sai->sa_family); - if(aconf == NULL || aconf->status & CONF_EXEMPTDLINE) - { - if(check_reject(new_client)) - return; - if(add_unknown_ip(new_client)) - return; - } - start_auth(new_client); } +static const char *toofast = "ERROR :Reconnecting too fast, throttled.\r\n"; + static int accept_precallback(rb_fde_t *F, struct sockaddr *addr, rb_socklen_t addrlen, void *data) { @@ -542,6 +533,16 @@ accept_precallback(rb_fde_t *F, struct sockaddr *addr, rb_socklen_t addrlen, voi return 0; } + if(check_reject(F, addr)) + return 0; + + if(throttle_add(addr)) + { + rb_write(F, toofast, strlen(toofast)); + rb_close(F); + return 0; + } + return 1; } diff --git a/src/newconf.c b/src/newconf.c index 92671f39..ed2dd9d3 100644 --- a/src/newconf.c +++ b/src/newconf.c @@ -2064,7 +2064,6 @@ static struct ConfEntry conf_general_table[] = { "max_nick_time", CF_TIME, NULL, 0, &ConfigFileEntry.max_nick_time }, { "max_nick_changes", CF_INT, NULL, 0, &ConfigFileEntry.max_nick_changes }, { "max_targets", CF_INT, NULL, 0, &ConfigFileEntry.max_targets }, - { "max_unknown_ip", CF_INT, NULL, 0, &ConfigFileEntry.max_unknown_ip }, { "min_nonwildcard", CF_INT, NULL, 0, &ConfigFileEntry.min_nonwildcard }, { "nick_delay", CF_TIME, NULL, 0, &ConfigFileEntry.nick_delay }, { "no_oper_flood", CF_YESNO, NULL, 0, &ConfigFileEntry.no_oper_flood }, @@ -2076,6 +2075,8 @@ static struct ConfEntry conf_general_table[] = { "reject_after_count", CF_INT, NULL, 0, &ConfigFileEntry.reject_after_count }, { "reject_ban_time", CF_TIME, NULL, 0, &ConfigFileEntry.reject_ban_time }, { "reject_duration", CF_TIME, NULL, 0, &ConfigFileEntry.reject_duration }, + { "throttle_count", CF_INT, NULL, 0, &ConfigFileEntry.throttle_count }, + { "throttle_duration", CF_TIME, NULL, 0, &ConfigFileEntry.throttle_duration }, { "short_motd", CF_YESNO, NULL, 0, &ConfigFileEntry.short_motd }, { "stats_c_oper_only", CF_YESNO, NULL, 0, &ConfigFileEntry.stats_c_oper_only }, { "stats_e_disabled", CF_YESNO, NULL, 0, &ConfigFileEntry.stats_e_disabled }, diff --git a/src/reject.c b/src/reject.c index d2422a4c..87ec3184 100644 --- a/src/reject.c +++ b/src/reject.c @@ -17,70 +17,79 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 * USA * - * $Id: reject.c 3456 2007-05-18 19:14:18Z jilles $ + * $Id: reject.c 25119 2008-03-13 16:57:05Z androsyn $ */ #include "stdinc.h" -#include "config.h" #include "client.h" #include "s_conf.h" #include "reject.h" #include "s_stats.h" -#include "msg.h" +#include "ircd.h" +#include "send.h" +#include "numeric.h" +#include "parse.h" +#include "hostmask.h" +#include "match.h" #include "hash.h" +static rb_patricia_tree_t *global_tree; static rb_patricia_tree_t *reject_tree; -rb_dlink_list delay_exit; +static rb_dlink_list delay_exit; static rb_dlink_list reject_list; +static rb_dlink_list throttle_list; +static rb_patricia_tree_t *throttle_tree; +static void throttle_expires(void *unused); -static rb_patricia_tree_t *unknown_tree; -struct reject_data +typedef struct _reject_data { rb_dlink_node rnode; time_t time; unsigned int count; uint32_t mask_hashv; -}; +} reject_t; + +typedef struct _delay_data +{ + rb_dlink_node node; + rb_fde_t *F; +} delay_t; + +typedef struct _throttle +{ + rb_dlink_node node; + time_t last; + int count; +} throttle_t; + +unsigned long +delay_exit_length(void) +{ + return rb_dlink_list_length(&delay_exit); +} static void reject_exit(void *unused) { - struct Client *client_p; rb_dlink_node *ptr, *ptr_next; - + delay_t *ddata; + static const char *errbuf = "ERROR :Closing Link: (*** Banned (cache))\r\n"; + RB_DLINK_FOREACH_SAFE(ptr, ptr_next, delay_exit.head) { - client_p = ptr->data; - if(IsDead(client_p)) - continue; + ddata = ptr->data; - /* this MUST be here, to prevent the possibility - * sendto_one() generates a write error, and then a client - * ends up on the dead_list and the abort_list --fl - * - * new disconnect notice stolen from ircu --nenolod - * no, this only happens when someone's IP has some - * ban on it and rejects them rather longer than the - * ircu message suggests --jilles - */ - if(!IsIOError(client_p)) - { - if(IsExUnknown(client_p)) - sendto_one(client_p, "ERROR :Closing Link: %s (*** Too many unknown connections)", client_p->host); - else - sendto_one(client_p, "ERROR :Closing Link: %s (*** Banned (cache))", client_p->host); - } - close_connection(client_p); - SetDead(client_p); - rb_dlinkAddAlloc(client_p, &dead_list); + rb_write(ddata->F, errbuf, strlen(errbuf)); + rb_close(ddata->F); + rb_free(ddata); } - delay_exit.head = delay_exit.tail = NULL; - delay_exit.length = 0; + delay_exit.head = delay_exit.tail = NULL; + delay_exit.length = 0; } static void @@ -88,7 +97,7 @@ reject_expires(void *unused) { rb_dlink_node *ptr, *next; rb_patricia_node_t *pnode; - struct reject_data *rdata; + reject_t *rdata; RB_DLINK_FOREACH_SAFE(ptr, next, reject_list.head) { @@ -108,9 +117,10 @@ void init_reject(void) { reject_tree = rb_new_patricia(PATRICIA_BITS); - unknown_tree = rb_new_patricia(PATRICIA_BITS); + throttle_tree = rb_new_patricia(PATRICIA_BITS); rb_event_add("reject_exit", reject_exit, NULL, DELAYED_EXIT_TIME); rb_event_add("reject_expires", reject_expires, NULL, 60); + rb_event_add("throttle_expires", throttle_expires, NULL, 10); } @@ -118,18 +128,18 @@ void add_reject(struct Client *client_p, const char *mask1, const char *mask2) { rb_patricia_node_t *pnode; - struct reject_data *rdata; + reject_t *rdata; uint32_t hashv; /* Reject is disabled */ - if(ConfigFileEntry.reject_after_count == 0 || ConfigFileEntry.reject_ban_time == 0) + if(ConfigFileEntry.reject_after_count == 0 || ConfigFileEntry.reject_duration == 0) return; hashv = 0; if (mask1 != NULL) - hashv ^= fnv_hash_upper(mask1, 32); + hashv ^= fnv_hash_upper((const unsigned char *)mask1, 32); if (mask2 != NULL) - hashv ^= fnv_hash_upper(mask2, 32); + hashv ^= fnv_hash_upper((const unsigned char *)mask2, 32); if((pnode = rb_match_ip(reject_tree, (struct sockaddr *)&client_p->localClient->ip)) != NULL) { @@ -141,11 +151,11 @@ add_reject(struct Client *client_p, const char *mask1, const char *mask2) { int bitlen = 32; #ifdef RB_IPV6 - if(client_p->localClient->ip.ss_family == AF_INET6) + if(GET_SS_FAMILY(&client_p->localClient->ip) == AF_INET6) bitlen = 128; #endif pnode = make_and_lookup_ip(reject_tree, (struct sockaddr *)&client_p->localClient->ip, bitlen); - pnode->data = rdata = rb_malloc(sizeof(struct reject_data)); + pnode->data = rdata = rb_malloc(sizeof(reject_t)); rb_dlinkAddTail(pnode, &rdata->rnode, &reject_list); rdata->time = rb_current_time(); rdata->count = 1; @@ -154,29 +164,28 @@ add_reject(struct Client *client_p, const char *mask1, const char *mask2) } int -check_reject(struct Client *client_p) +check_reject(rb_fde_t *F, struct sockaddr *addr) { rb_patricia_node_t *pnode; - struct reject_data *rdata; - + reject_t *rdata; + delay_t *ddata; /* Reject is disabled */ - if(ConfigFileEntry.reject_after_count == 0 || ConfigFileEntry.reject_ban_time == 0 || - ConfigFileEntry.reject_duration == 0) + if(ConfigFileEntry.reject_after_count == 0 || ConfigFileEntry.reject_duration == 0) return 0; - pnode = rb_match_ip(reject_tree, (struct sockaddr *)&client_p->localClient->ip); + pnode = rb_match_ip(reject_tree, addr); if(pnode != NULL) { rdata = pnode->data; rdata->time = rb_current_time(); - if(rdata->count > ConfigFileEntry.reject_after_count) + if(rdata->count > (unsigned long)ConfigFileEntry.reject_after_count) { + ddata = rb_malloc(sizeof(delay_t)); ServerStats.is_rej++; - SetReject(client_p); - rb_setselect(client_p->localClient->F, RB_SELECT_WRITE | RB_SELECT_READ, NULL, NULL); - SetClosing(client_p); - rb_dlinkMoveNode(&client_p->localClient->tnode, &unknown_list, &delay_exit); + rb_setselect(F, RB_SELECT_WRITE | RB_SELECT_READ, NULL, NULL); + ddata->F = F; + rb_dlinkAdd(ddata, &ddata->node, &delay_exit); return 1; } } @@ -189,7 +198,7 @@ flush_reject(void) { rb_dlink_node *ptr, *next; rb_patricia_node_t *pnode; - struct reject_data *rdata; + reject_t *rdata; RB_DLINK_FOREACH_SAFE(ptr, next, reject_list.head) { @@ -207,13 +216,12 @@ remove_reject_ip(const char *ip) rb_patricia_node_t *pnode; /* Reject is disabled */ - if(ConfigFileEntry.reject_after_count == 0 || ConfigFileEntry.reject_ban_time == 0 || - ConfigFileEntry.reject_duration == 0) + if(ConfigFileEntry.reject_after_count == 0 || ConfigFileEntry.reject_duration == 0) return -1; if((pnode = rb_match_string(reject_tree, ip)) != NULL) { - struct reject_data *rdata = pnode->data; + reject_t *rdata = pnode->data; rb_dlinkDelete(&rdata->rnode, &reject_list); rb_free(rdata); rb_patricia_remove(reject_tree, pnode); @@ -227,15 +235,15 @@ remove_reject_mask(const char *mask1, const char *mask2) { rb_dlink_node *ptr, *next; rb_patricia_node_t *pnode; - struct reject_data *rdata; + reject_t *rdata; uint32_t hashv; int n = 0; hashv = 0; if (mask1 != NULL) - hashv ^= fnv_hash_upper(mask1, 32); + hashv ^= fnv_hash_upper((const unsigned char *)mask1, 32); if (mask2 != NULL) - hashv ^= fnv_hash_upper(mask2, 32); + hashv ^= fnv_hash_upper((const unsigned char *)mask2, 32); RB_DLINK_FOREACH_SAFE(ptr, next, reject_list.head) { pnode = ptr->data; @@ -251,50 +259,57 @@ remove_reject_mask(const char *mask1, const char *mask2) return n; } - int -add_unknown_ip(struct Client *client_p) +throttle_add(struct sockaddr *addr) { + throttle_t *t; rb_patricia_node_t *pnode; - if((pnode = rb_match_ip(unknown_tree, (struct sockaddr *)&client_p->localClient->ip)) == NULL) + if((pnode = rb_match_ip(throttle_tree, addr)) != NULL) { + t = pnode->data; + + if(t->count > ConfigFileEntry.throttle_count) + return 1; + + /* Stop penalizing them after they've been throttled */ + t->last = rb_current_time(); + t->count++; + + } else { int bitlen = 32; #ifdef RB_IPV6 - if(client_p->localClient->ip.ss_family == AF_INET6) + if(GET_SS_FAMILY(addr) == AF_INET6) bitlen = 128; #endif - pnode = make_and_lookup_ip(unknown_tree, (struct sockaddr *)&client_p->localClient->ip, bitlen); - pnode->data = (void *)0; - } - - if((unsigned long)pnode->data >= ConfigFileEntry.max_unknown_ip) - { - SetExUnknown(client_p); - SetReject(client_p); - rb_setselect(client_p->localClient->F, RB_SELECT_WRITE | RB_SELECT_READ, NULL, NULL); - SetClosing(client_p); - rb_dlinkMoveNode(&client_p->localClient->tnode, &unknown_list, &delay_exit); - return 1; - } - - pnode->data = (void *)((unsigned long)pnode->data + 1); - + t = rb_malloc(sizeof(throttle_t)); + t->last = rb_current_time(); + t->count = 1; + pnode = make_and_lookup_ip(throttle_tree, addr, bitlen); + pnode->data = t; + rb_dlinkAdd(pnode, &t->node, &throttle_list); + } return 0; } -void -del_unknown_ip(struct Client *client_p) +static void +throttle_expires(void *unused) { + rb_dlink_node *ptr, *next; rb_patricia_node_t *pnode; - - if((pnode = rb_match_ip(unknown_tree, (struct sockaddr *)&client_p->localClient->ip)) != NULL) + throttle_t *t; + + RB_DLINK_FOREACH_SAFE(ptr, next, throttle_list.head) { - pnode->data = (void *)((unsigned long)pnode->data - 1); - if((unsigned long)pnode->data <= 0) - { - rb_patricia_remove(unknown_tree, pnode); - } + pnode = ptr->data; + t = pnode->data; + + if(t->last + ConfigFileEntry.throttle_duration > rb_current_time()) + continue; + + rb_dlinkDelete(ptr, &throttle_list); + rb_free(t); + rb_patricia_remove(throttle_tree, pnode); } - /* this can happen due to m_webirc.c's manipulations, for example */ } + diff --git a/src/s_conf.c b/src/s_conf.c index f27c6aba..71f1c56c 100644 --- a/src/s_conf.c +++ b/src/s_conf.c @@ -820,7 +820,8 @@ set_default_conf(void) ConfigFileEntry.reject_after_count = 5; ConfigFileEntry.reject_ban_time = 300; ConfigFileEntry.reject_duration = 120; - ConfigFileEntry.max_unknown_ip = 2; + ConfigFileEntry.throttle_count = 4; + ConfigFileEntry.throttle_duration = 60; ServerInfo.default_max_clients = MAXCONNECTIONS; } diff --git a/src/s_serv.c b/src/s_serv.c index daff36c7..e29fdba0 100644 --- a/src/s_serv.c +++ b/src/s_serv.c @@ -760,7 +760,6 @@ server_estab(struct Client *client_p) set_chcap_usage_counts(client_p); rb_dlinkAdd(client_p, &client_p->lnode, &me.serv->servers); - del_unknown_ip(client_p); rb_dlinkMoveNode(&client_p->localClient->tnode, &unknown_list, &serv_list); rb_dlinkAddTailAlloc(client_p, &global_serv_list); diff --git a/src/s_user.c b/src/s_user.c index 6407c051..57f3432e 100644 --- a/src/s_user.c +++ b/src/s_user.c @@ -527,7 +527,6 @@ register_local_user(struct Client *client_p, struct Client *source_p, const char Count.invisi++; s_assert(!IsClient(source_p)); - del_unknown_ip(source_p); rb_dlinkMoveNode(&source_p->localClient->tnode, &unknown_list, &lclient_list); SetClient(source_p);