1 /*
2 * Copyright (c) 2020 Darren Tucker <dtucker@openbsd.org>
3 *
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
7 *
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 */
16
17 #include "includes.h"
18
19 #include <sys/socket.h>
20 #include <sys/types.h>
21
22 #include <limits.h>
23 #include <netdb.h>
24 #include <stdio.h>
25 #include <string.h>
26
27 #include "addr.h"
28 #include "canohost.h"
29 #include "log.h"
30 #include "misc.h"
31 #include "srclimit.h"
32 #include "xmalloc.h"
33
34 static int max_children, max_persource, ipv4_masklen, ipv6_masklen;
35
36 /* Per connection state, used to enforce unauthenticated connection limit. */
37 static struct child_info {
38 int id;
39 struct xaddr addr;
40 } *child;
41
42 void
srclimit_init(int max,int persource,int ipv4len,int ipv6len)43 srclimit_init(int max, int persource, int ipv4len, int ipv6len)
44 {
45 int i;
46
47 max_children = max;
48 ipv4_masklen = ipv4len;
49 ipv6_masklen = ipv6len;
50 max_persource = persource;
51 if (max_persource == INT_MAX) /* no limit */
52 return;
53 debug("%s: max connections %d, per source %d, masks %d,%d", __func__,
54 max, persource, ipv4len, ipv6len);
55 if (max <= 0)
56 fatal("%s: invalid number of sockets: %d", __func__, max);
57 child = xcalloc(max_children, sizeof(*child));
58 for (i = 0; i < max_children; i++)
59 child[i].id = -1;
60 }
61
62 /* returns 1 if connection allowed, 0 if not allowed. */
63 int
srclimit_check_allow(int sock,int id)64 srclimit_check_allow(int sock, int id)
65 {
66 struct xaddr xa, xb, xmask;
67 struct sockaddr_storage addr;
68 socklen_t addrlen = sizeof(addr);
69 struct sockaddr *sa = (struct sockaddr *)&addr;
70 int i, bits, first_unused, count = 0;
71 char xas[NI_MAXHOST];
72
73 if (max_persource == INT_MAX) /* no limit */
74 return 1;
75
76 debug("%s: sock %d id %d limit %d", __func__, sock, id, max_persource);
77 if (getpeername(sock, sa, &addrlen) != 0)
78 return 1; /* not remote socket? */
79 if (addr_sa_to_xaddr(sa, addrlen, &xa) != 0)
80 return 1; /* unknown address family? */
81
82 /* Mask address off address to desired size. */
83 bits = xa.af == AF_INET ? ipv4_masklen : ipv6_masklen;
84 if (addr_netmask(xa.af, bits, &xmask) != 0 ||
85 addr_and(&xb, &xa, &xmask) != 0) {
86 debug3("%s: invalid mask %d bits", __func__, bits);
87 return 1;
88 }
89
90 first_unused = max_children;
91 /* Count matching entries and find first unused one. */
92 for (i = 0; i < max_children; i++) {
93 if (child[i].id == -1) {
94 if (i < first_unused)
95 first_unused = i;
96 } else if (addr_cmp(&child[i].addr, &xb) == 0) {
97 count++;
98 }
99 }
100 if (addr_ntop(&xa, xas, sizeof(xas)) != 0) {
101 debug3("%s: addr ntop failed", __func__);
102 return 1;
103 }
104 debug3("%s: new unauthenticated connection from %s/%d, at %d of %d",
105 __func__, xas, bits, count, max_persource);
106
107 if (first_unused == max_children) { /* no free slot found */
108 debug3("%s: no free slot", __func__);
109 return 0;
110 }
111 if (first_unused < 0 || first_unused >= max_children)
112 fatal("%s: internal error: first_unused out of range",
113 __func__);
114
115 if (count >= max_persource)
116 return 0;
117
118 /* Connection allowed, store masked address. */
119 child[first_unused].id = id;
120 memcpy(&child[first_unused].addr, &xb, sizeof(xb));
121 return 1;
122 }
123
124 void
srclimit_done(int id)125 srclimit_done(int id)
126 {
127 int i;
128
129 if (max_persource == INT_MAX) /* no limit */
130 return;
131
132 debug("%s: id %d", __func__, id);
133 /* Clear corresponding state entry. */
134 for (i = 0; i < max_children; i++) {
135 if (child[i].id == id) {
136 child[i].id = -1;
137 return;
138 }
139 }
140 }
141