1 /* 2 * Copyright (c) 2020 Darren Tucker <dtucker@openbsd.org> 3 * 4 * Permission to use, copy, modify, and distribute this software for any 5 * purpose with or without fee is hereby granted, provided that the above 6 * copyright notice and this permission notice appear in all copies. 7 * 8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 */ 16 17 #include "includes.h" 18 19 #include <sys/socket.h> 20 #include <sys/types.h> 21 22 #include <limits.h> 23 #include <netdb.h> 24 #include <stdio.h> 25 #include <string.h> 26 27 #include "addr.h" 28 #include "canohost.h" 29 #include "log.h" 30 #include "misc.h" 31 #include "srclimit.h" 32 #include "xmalloc.h" 33 34 static int max_children, max_persource, ipv4_masklen, ipv6_masklen; 35 36 /* Per connection state, used to enforce unauthenticated connection limit. */ 37 static struct child_info { 38 int id; 39 struct xaddr addr; 40 } *child; 41 42 void 43 srclimit_init(int max, int persource, int ipv4len, int ipv6len) 44 { 45 int i; 46 47 max_children = max; 48 ipv4_masklen = ipv4len; 49 ipv6_masklen = ipv6len; 50 max_persource = persource; 51 if (max_persource == INT_MAX) /* no limit */ 52 return; 53 debug("%s: max connections %d, per source %d, masks %d,%d", __func__, 54 max, persource, ipv4len, ipv6len); 55 if (max <= 0) 56 fatal("%s: invalid number of sockets: %d", __func__, max); 57 child = xcalloc(max_children, sizeof(*child)); 58 for (i = 0; i < max_children; i++) 59 child[i].id = -1; 60 } 61 62 /* returns 1 if connection allowed, 0 if not allowed. */ 63 int 64 srclimit_check_allow(int sock, int id) 65 { 66 struct xaddr xa, xb, xmask; 67 struct sockaddr_storage addr; 68 socklen_t addrlen = sizeof(addr); 69 struct sockaddr *sa = (struct sockaddr *)&addr; 70 int i, bits, first_unused, count = 0; 71 char xas[NI_MAXHOST]; 72 73 if (max_persource == INT_MAX) /* no limit */ 74 return 1; 75 76 debug("%s: sock %d id %d limit %d", __func__, sock, id, max_persource); 77 if (getpeername(sock, sa, &addrlen) != 0) 78 return 1; /* not remote socket? */ 79 if (addr_sa_to_xaddr(sa, addrlen, &xa) != 0) 80 return 1; /* unknown address family? */ 81 82 /* Mask address off address to desired size. */ 83 bits = xa.af == AF_INET ? ipv4_masklen : ipv6_masklen; 84 if (addr_netmask(xa.af, bits, &xmask) != 0 || 85 addr_and(&xb, &xa, &xmask) != 0) { 86 debug3("%s: invalid mask %d bits", __func__, bits); 87 return 1; 88 } 89 90 first_unused = max_children; 91 /* Count matching entries and find first unused one. */ 92 for (i = 0; i < max_children; i++) { 93 if (child[i].id == -1) { 94 if (i < first_unused) 95 first_unused = i; 96 } else if (addr_cmp(&child[i].addr, &xb) == 0) { 97 count++; 98 } 99 } 100 if (addr_ntop(&xa, xas, sizeof(xas)) != 0) { 101 debug3("%s: addr ntop failed", __func__); 102 return 1; 103 } 104 debug3("%s: new unauthenticated connection from %s/%d, at %d of %d", 105 __func__, xas, bits, count, max_persource); 106 107 if (first_unused == max_children) { /* no free slot found */ 108 debug3("%s: no free slot", __func__); 109 return 0; 110 } 111 if (first_unused < 0 || first_unused >= max_children) 112 fatal("%s: internal error: first_unused out of range", 113 __func__); 114 115 if (count >= max_persource) 116 return 0; 117 118 /* Connection allowed, store masked address. */ 119 child[first_unused].id = id; 120 memcpy(&child[first_unused].addr, &xb, sizeof(xb)); 121 return 1; 122 } 123 124 void 125 srclimit_done(int id) 126 { 127 int i; 128 129 if (max_persource == INT_MAX) /* no limit */ 130 return; 131 132 debug("%s: id %d", __func__, id); 133 /* Clear corresponding state entry. */ 134 for (i = 0; i < max_children; i++) { 135 if (child[i].id == id) { 136 child[i].id = -1; 137 return; 138 } 139 } 140 } 141