X-Git-Url: https://jfr.im/git/irc/rqf/shadowircd.git/blobdiff_plain/90a3c35b295b07ebe3793bf5d3b882c3c1a5dc7c..760ef9e1ea59f448a2ea3dadf1aa100bb56816ba:/src/reject.c diff --git a/src/reject.c b/src/reject.c index aaf8fab..c9c7d45 100644 --- a/src/reject.c +++ b/src/reject.c @@ -17,169 +17,193 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 * USA * - * $Id: reject.c 3456 2007-05-18 19:14:18Z jilles $ + * $Id: reject.c 25119 2008-03-13 16:57:05Z androsyn $ */ #include "stdinc.h" -#include "config.h" -#include "patricia.h" #include "client.h" #include "s_conf.h" #include "reject.h" #include "s_stats.h" -#include "msg.h" +#include "ircd.h" +#include "send.h" +#include "numeric.h" +#include "parse.h" +#include "hostmask.h" +#include "match.h" #include "hash.h" -static patricia_tree_t *reject_tree; -rb_dlink_list delay_exit; +static rb_patricia_tree_t *reject_tree; +static rb_dlink_list delay_exit; static rb_dlink_list reject_list; +static rb_dlink_list throttle_list; +static rb_patricia_tree_t *throttle_tree; +static void throttle_expires(void *unused); -static patricia_tree_t *unknown_tree; -struct reject_data +typedef struct _reject_data { rb_dlink_node rnode; time_t time; unsigned int count; uint32_t mask_hashv; -}; +} reject_t; -static patricia_tree_t *unknown_tree; +typedef struct _delay_data +{ + rb_dlink_node node; + rb_fde_t *F; +} delay_t; + +typedef struct _throttle +{ + rb_dlink_node node; + time_t last; + int count; +} throttle_t; + +unsigned long +delay_exit_length(void) +{ + return rb_dlink_list_length(&delay_exit); +} static void reject_exit(void *unused) { - struct Client *client_p; rb_dlink_node *ptr, *ptr_next; - + delay_t *ddata; + static const char *errbuf = "ERROR :Closing Link: (*** Banned (cache))\r\n"; + RB_DLINK_FOREACH_SAFE(ptr, ptr_next, delay_exit.head) { - client_p = ptr->data; - if(IsDead(client_p)) - continue; - - /* this MUST be here, to prevent the possibility - * sendto_one() generates a write error, and then a client - * ends up on the dead_list and the abort_list --fl - * - * new disconnect notice stolen from ircu --nenolod - * no, this only happens when someone's IP has some - * ban on it and rejects them rather longer than the - * ircu message suggests --jilles - */ - if(!IsIOError(client_p)) - { - if(IsExUnknown(client_p)) - sendto_one(client_p, "ERROR :Closing Link: %s (*** Too many unknown connections)", client_p->host); - else - sendto_one(client_p, "ERROR :Closing Link: %s (*** Banned (cache))", client_p->host); - } - close_connection(client_p); - SetDead(client_p); - rb_dlinkAddAlloc(client_p, &dead_list); + ddata = ptr->data; + + rb_write(ddata->F, errbuf, strlen(errbuf)); + rb_close(ddata->F); + rb_free(ddata); } - delay_exit.head = delay_exit.tail = NULL; - delay_exit.length = 0; + delay_exit.head = delay_exit.tail = NULL; + delay_exit.length = 0; } static void reject_expires(void *unused) { rb_dlink_node *ptr, *next; - patricia_node_t *pnode; - struct reject_data *rdata; + rb_patricia_node_t *pnode; + reject_t *rdata; RB_DLINK_FOREACH_SAFE(ptr, next, reject_list.head) { pnode = ptr->data; rdata = pnode->data; - if(rdata->time + ConfigFileEntry.reject_duration > CurrentTime) + if(rdata->time + ConfigFileEntry.reject_duration > rb_current_time()) continue; rb_dlinkDelete(ptr, &reject_list); rb_free(rdata); - patricia_remove(reject_tree, pnode); + rb_patricia_remove(reject_tree, pnode); } } void init_reject(void) { - reject_tree = New_Patricia(PATRICIA_BITS); - unknown_tree = New_Patricia(PATRICIA_BITS); - eventAdd("reject_exit", reject_exit, NULL, DELAYED_EXIT_TIME); - eventAdd("reject_expires", reject_expires, NULL, 60); + reject_tree = rb_new_patricia(PATRICIA_BITS); + throttle_tree = rb_new_patricia(PATRICIA_BITS); + rb_event_add("reject_exit", reject_exit, NULL, DELAYED_EXIT_TIME); + rb_event_add("reject_expires", reject_expires, NULL, 60); + rb_event_add("throttle_expires", throttle_expires, NULL, 10); } +unsigned long +throttle_size(void) +{ + unsigned long count; + rb_dlink_node *ptr; + rb_patricia_node_t *pnode; + throttle_t *t; + + count = 0; + RB_DLINK_FOREACH(ptr, throttle_list.head) + { + pnode = ptr->data; + t = pnode->data; + if (t->count > ConfigFileEntry.throttle_count) + count++; + } + + return count; +} void add_reject(struct Client *client_p, const char *mask1, const char *mask2) { - patricia_node_t *pnode; - struct reject_data *rdata; + rb_patricia_node_t *pnode; + reject_t *rdata; uint32_t hashv; /* Reject is disabled */ - if(ConfigFileEntry.reject_after_count == 0 || ConfigFileEntry.reject_ban_time == 0) + if(ConfigFileEntry.reject_after_count == 0 || ConfigFileEntry.reject_duration == 0) return; hashv = 0; if (mask1 != NULL) - hashv ^= fnv_hash_upper(mask1, 32); + hashv ^= fnv_hash_upper((const unsigned char *)mask1, 32); if (mask2 != NULL) - hashv ^= fnv_hash_upper(mask2, 32); + hashv ^= fnv_hash_upper((const unsigned char *)mask2, 32); - if((pnode = match_ip(reject_tree, (struct sockaddr *)&client_p->localClient->ip)) != NULL) + if((pnode = rb_match_ip(reject_tree, (struct sockaddr *)&client_p->localClient->ip)) != NULL) { rdata = pnode->data; - rdata->time = CurrentTime; + rdata->time = rb_current_time(); rdata->count++; } else { int bitlen = 32; -#ifdef IPV6 - if(client_p->localClient->ip.ss_family == AF_INET6) +#ifdef RB_IPV6 + if(GET_SS_FAMILY(&client_p->localClient->ip) == AF_INET6) bitlen = 128; #endif pnode = make_and_lookup_ip(reject_tree, (struct sockaddr *)&client_p->localClient->ip, bitlen); - pnode->data = rdata = MyMalloc(sizeof(struct reject_data)); + pnode->data = rdata = rb_malloc(sizeof(reject_t)); rb_dlinkAddTail(pnode, &rdata->rnode, &reject_list); - rdata->time = CurrentTime; + rdata->time = rb_current_time(); rdata->count = 1; } rdata->mask_hashv = hashv; } int -check_reject(struct Client *client_p) +check_reject(rb_fde_t *F, struct sockaddr *addr) { - patricia_node_t *pnode; - struct reject_data *rdata; - + rb_patricia_node_t *pnode; + reject_t *rdata; + delay_t *ddata; /* Reject is disabled */ - if(ConfigFileEntry.reject_after_count == 0 || ConfigFileEntry.reject_ban_time == 0 || - ConfigFileEntry.reject_duration == 0) + if(ConfigFileEntry.reject_after_count == 0 || ConfigFileEntry.reject_duration == 0) return 0; - pnode = match_ip(reject_tree, (struct sockaddr *)&client_p->localClient->ip); + pnode = rb_match_ip(reject_tree, addr); if(pnode != NULL) { rdata = pnode->data; - rdata->time = CurrentTime; - if(rdata->count > ConfigFileEntry.reject_after_count) + rdata->time = rb_current_time(); + if(rdata->count > (unsigned long)ConfigFileEntry.reject_after_count) { - ServerStats->is_rej++; - SetReject(client_p); - rb_setselect(client_p->localClient->F->fd, FDLIST_NONE, COMM_SELECT_WRITE | COMM_SELECT_READ, NULL, NULL, 0); - SetClosing(client_p); - rb_dlinkMoveNode(&client_p->localClient->tnode, &unknown_list, &delay_exit); + ddata = rb_malloc(sizeof(delay_t)); + ServerStats.is_rej++; + rb_setselect(F, RB_SELECT_WRITE | RB_SELECT_READ, NULL, NULL); + ddata->F = F; + rb_dlinkAdd(ddata, &ddata->node, &delay_exit); return 1; } } @@ -187,12 +211,37 @@ check_reject(struct Client *client_p) return 0; } +int +is_reject_ip(struct sockaddr *addr) +{ + rb_patricia_node_t *pnode; + reject_t *rdata; + int duration; + + /* Reject is disabled */ + if(ConfigFileEntry.reject_after_count == 0 || ConfigFileEntry.reject_duration == 0) + return 0; + + pnode = rb_match_ip(reject_tree, addr); + if(pnode != NULL) + { + rdata = pnode->data; + + if(rdata->count > (unsigned long)ConfigFileEntry.reject_after_count) + { + duration = rdata->time + ConfigFileEntry.reject_duration - rb_current_time(); + return duration > 0 ? duration : 1; + } + } + return 0; +} + void flush_reject(void) { rb_dlink_node *ptr, *next; - patricia_node_t *pnode; - struct reject_data *rdata; + rb_patricia_node_t *pnode; + reject_t *rdata; RB_DLINK_FOREACH_SAFE(ptr, next, reject_list.head) { @@ -200,26 +249,25 @@ flush_reject(void) rdata = pnode->data; rb_dlinkDelete(ptr, &reject_list); rb_free(rdata); - patricia_remove(reject_tree, pnode); + rb_patricia_remove(reject_tree, pnode); } } int remove_reject_ip(const char *ip) { - patricia_node_t *pnode; + rb_patricia_node_t *pnode; /* Reject is disabled */ - if(ConfigFileEntry.reject_after_count == 0 || ConfigFileEntry.reject_ban_time == 0 || - ConfigFileEntry.reject_duration == 0) + if(ConfigFileEntry.reject_after_count == 0 || ConfigFileEntry.reject_duration == 0) return -1; - if((pnode = match_string(reject_tree, ip)) != NULL) + if((pnode = rb_match_string(reject_tree, ip)) != NULL) { - struct reject_data *rdata = pnode->data; + reject_t *rdata = pnode->data; rb_dlinkDelete(&rdata->rnode, &reject_list); rb_free(rdata); - patricia_remove(reject_tree, pnode); + rb_patricia_remove(reject_tree, pnode); return 1; } return 0; @@ -229,16 +277,16 @@ int remove_reject_mask(const char *mask1, const char *mask2) { rb_dlink_node *ptr, *next; - patricia_node_t *pnode; - struct reject_data *rdata; + rb_patricia_node_t *pnode; + reject_t *rdata; uint32_t hashv; int n = 0; hashv = 0; if (mask1 != NULL) - hashv ^= fnv_hash_upper(mask1, 32); + hashv ^= fnv_hash_upper((const unsigned char *)mask1, 32); if (mask2 != NULL) - hashv ^= fnv_hash_upper(mask2, 32); + hashv ^= fnv_hash_upper((const unsigned char *)mask2, 32); RB_DLINK_FOREACH_SAFE(ptr, next, reject_list.head) { pnode = ptr->data; @@ -247,57 +295,85 @@ remove_reject_mask(const char *mask1, const char *mask2) { rb_dlinkDelete(ptr, &reject_list); rb_free(rdata); - patricia_remove(reject_tree, pnode); + rb_patricia_remove(reject_tree, pnode); n++; } } return n; } - int -add_unknown_ip(struct Client *client_p) +throttle_add(struct sockaddr *addr) { - patricia_node_t *pnode; + throttle_t *t; + rb_patricia_node_t *pnode; - if((pnode = match_ip(unknown_tree, (struct sockaddr *)&client_p->localClient->ip)) == NULL) + if((pnode = rb_match_ip(throttle_tree, addr)) != NULL) { + t = pnode->data; + + if(t->count > ConfigFileEntry.throttle_count) + { + ServerStats.is_thr++; + return 1; + } + /* Stop penalizing them after they've been throttled */ + t->last = rb_current_time(); + t->count++; + + } else { int bitlen = 32; -#ifdef IPV6 - if(client_p->localClient->ip.ss_family == AF_INET6) +#ifdef RB_IPV6 + if(GET_SS_FAMILY(addr) == AF_INET6) bitlen = 128; #endif - pnode = make_and_lookup_ip(unknown_tree, (struct sockaddr *)&client_p->localClient->ip, bitlen); - pnode->data = (void *)0; - } - - if((unsigned long)pnode->data >= ConfigFileEntry.max_unknown_ip) - { - SetExUnknown(client_p); - SetReject(client_p); - rb_setselect(client_p->localClient->F->fd, FDLIST_NONE, COMM_SELECT_WRITE | COMM_SELECT_READ, NULL, NULL, 0); - SetClosing(client_p); - rb_dlinkMoveNode(&client_p->localClient->tnode, &unknown_list, &delay_exit); - return 1; - } - - pnode->data = (void *)((unsigned long)pnode->data + 1); - + t = rb_malloc(sizeof(throttle_t)); + t->last = rb_current_time(); + t->count = 1; + pnode = make_and_lookup_ip(throttle_tree, addr, bitlen); + pnode->data = t; + rb_dlinkAdd(pnode, &t->node, &throttle_list); + } return 0; } -void -del_unknown_ip(struct Client *client_p) +int +is_throttle_ip(struct sockaddr *addr) { - patricia_node_t *pnode; + throttle_t *t; + rb_patricia_node_t *pnode; + int duration; - if((pnode = match_ip(unknown_tree, (struct sockaddr *)&client_p->localClient->ip)) != NULL) + if((pnode = rb_match_ip(throttle_tree, addr)) != NULL) { - pnode->data = (void *)((unsigned long)pnode->data - 1); - if((unsigned long)pnode->data <= 0) + t = pnode->data; + if(t->count > ConfigFileEntry.throttle_count) { - patricia_remove(unknown_tree, pnode); + duration = t->last + ConfigFileEntry.throttle_duration - rb_current_time(); + return duration > 0 ? duration : 1; } } - /* this can happen due to m_webirc.c's manipulations, for example */ + return 0; +} + +static void +throttle_expires(void *unused) +{ + rb_dlink_node *ptr, *next; + rb_patricia_node_t *pnode; + throttle_t *t; + + RB_DLINK_FOREACH_SAFE(ptr, next, throttle_list.head) + { + pnode = ptr->data; + t = pnode->data; + + if(t->last + ConfigFileEntry.throttle_duration > rb_current_time()) + continue; + + rb_dlinkDelete(ptr, &throttle_list); + rb_free(t); + rb_patricia_remove(throttle_tree, pnode); + } } +