mod.dronescan: Added grace period after a netsplit (Issue #15)

* Added config parameter jcGracePeriodBurstOrSplit
* Fixed typo in default gline reason ("tollerated" -> "tolerated")

diff --git a/bin/dronescan.example.conf b/bin/dronescan.example.conf
index 1859f77b24061774b787ffc43c668b6aff4cb0c8..c6cf0ed663a5d19c131eba81bb9e29f1379cac6e 100644 (file)
--- a/bin/dronescan.example.conf
+++ b/bin/dronescan.example.conf
@@ -100,8 +100,11 @@ jcMinJFJOnlySizeToGline = 25
 # The minimum number of flooding clients required to gline
 jcMinJFSizeToGline = 20
 
+# Grace period (no glines set) after a net burst or a net join
+jcGracePeriodBurstOrSplit = 60
+
 # The gline reason to set when glining join flood offenders
-jcGlineReason = Flooding is not tollerated on this network!
+jcGlineReason = Flooding is not tolerated on this network
 
 # The length in seconds for glines which are issued on join flood offenders
 jcGlineLength = 3600

diff --git a/mod.dronescan/dronescan.cc b/mod.dronescan/dronescan.cc
index 5ef0aa89b590a167dd5bf68d00661d933fb7a98f..e4f992ca54dd0b7b4ad5de936173e20c8741561d 100644 (file)
--- a/mod.dronescan/dronescan.cc
+++ b/mod.dronescan/dronescan.cc
@@ -130,6 +130,7 @@ ncInterval = atoi(dronescanConfig->Require("ncInterval")->second.c_str());
 ncCutoff = atoi(dronescanConfig->Require("ncCutoff")->second.c_str());
 rcInterval = atoi(dronescanConfig->Require("rcInterval")->second.c_str());
 jcMinJoinToGline = atoi(dronescanConfig->Require("jcMinJoinToGline")->second.c_str());
+jcGracePeriodBurstOrSplit = atoi(dronescanConfig->Require("jcGracePeriodBurstOrSplit")->second.c_str());
 jcMinJoinToGlineJOnly = atoi(dronescanConfig->Require("jcMinJoinToGlineJOnly")->second.c_str());
 jcMinJoinsPerIPToGline = atoi(dronescanConfig->Require("jcMinJoinsPerIPToGline")->second.c_str());
 jcJoinsPerIPTime = atoi(dronescanConfig->Require("jcJoinsPerIPTime")->second.c_str());
@@ -379,6 +380,7 @@ void dronescan::OnEvent( const eventType& theEvent,
                        }
                case EVT_NETBREAK :
                        {
+                       lastSplitTime = ::time(0);
                        updateState();
                        break;
                        }
@@ -818,7 +820,7 @@ for(jcChanMapType::const_iterator itr = jcChanMap.begin() ;
                bool isoktogline2 = false;
                for(;joinPartIt != joinPartEnd; ++joinPartIt )
                        {
-                               isoktogline = ((::time(0) - lastBurstTime) > 25 && jcGlineEnable && jChannel->getNumOfJoins() > jcMinJFSizeToGline && (jChannel->getNumOfParts() > jcMinJFSizeToGline || (joinPartIt->second.numOfJoins >= jcMinJoinToGlineJOnly && jChannel->getNumOfJoins() >= jcMinJFJOnlySizeToGline))) ? true : false;
+                               isoktogline = ((::time(0) - lastBurstTime) >= (jcGracePeriodBurstOrSplit / 2) && (::time(0) - lastSplitTime) >= (jcGracePeriodBurstOrSplit / 2) && jcGlineEnable && jChannel->getNumOfJoins() > jcMinJFSizeToGline && (jChannel->getNumOfParts() > jcMinJFSizeToGline || (joinPartIt->second.numOfJoins >= jcMinJoinToGlineJOnly && jChannel->getNumOfJoins() >= jcMinJFJOnlySizeToGline))) ? true : false;
                                if (isoktogline)
                                        isoktogline2 = true;
 #ifdef ENABLE_LOG4CPLUS
@@ -1246,7 +1248,7 @@ if( droneChanItr != droneChannels.end() )
        }
 
 /* Do join count processing if applicable */
-if ((::time(0) - lastBurstTime) < 60)
+if ((::time(0) - lastBurstTime) < jcGracePeriodBurstOrSplit)
        return;  /* Don't report join/floods right after a burst */
 const string& channelName = theChannel->getName();
 jcChanMapIterator jcChanIt = jcChanMap.find(channelName);
@@ -1277,7 +1279,7 @@ if(channel->getJoinFlooded())
        if (joinCount >= jcCutoff) {
                string IP = xIP(theClient->getIP()).GetNumericIP();
                jcFloodClients* jcFC;
-               if ((::time(0) - lastBurstTime) >= 60 && jcGlineEnable) {
+               if ((::time(0) - lastBurstTime) >= jcGracePeriodBurstOrSplit && jcGlineEnable) {
                        clientsIPFloodMapType::const_iterator Itr = clientsIPFloodMap.find(IP);
                        if (Itr != clientsIPFloodMap.end()) {
                                jcFC = Itr->second;

diff --git a/mod.dronescan/dronescan.h b/mod.dronescan/dronescan.h
index af0220955b49c3dda8e22671059a8730dfcbda20..207287a1125277fb9373e5ecdc41bed716919bf5 100644 (file)
--- a/mod.dronescan/dronescan.h
+++ b/mod.dronescan/dronescan.h
@@ -230,6 +230,7 @@ public:
        clientsIPMapType clientsIPMap;
        clientsIPFloodMapType clientsIPFloodMap;
        int lastBurstTime;
+       int lastSplitTime;
 
        /** Typedef of currently seen drone channels */
        typedef std::map< std::string , activeChannel* > droneChannelsType;
@@ -256,6 +257,7 @@ public:
        /** Join counter config options */
        unsigned int jcInterval;
        unsigned int jcCutoff;
+       unsigned int jcGracePeriodBurstOrSplit;
        unsigned int jcMinJoinToGline;
        unsigned int jcMinJoinToGlineJOnly;
        unsigned int jcMinJoinsPerIPToGline;