119261079SEd Maste /* 219261079SEd Maste * Copyright (c) 2020 Darren Tucker <dtucker@openbsd.org> 319261079SEd Maste * 419261079SEd Maste * Permission to use, copy, modify, and distribute this software for any 519261079SEd Maste * purpose with or without fee is hereby granted, provided that the above 619261079SEd Maste * copyright notice and this permission notice appear in all copies. 719261079SEd Maste * 819261079SEd Maste * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 919261079SEd Maste * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 1019261079SEd Maste * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 1119261079SEd Maste * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 1219261079SEd Maste * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 1319261079SEd Maste * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 1419261079SEd Maste * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 1519261079SEd Maste */ 160fdf8faeSEd Maste struct xaddr; 170fdf8faeSEd Maste 180fdf8faeSEd Maste struct per_source_penalty; 190fdf8faeSEd Maste 200fdf8faeSEd Maste void srclimit_init(int, int, int, int, 210fdf8faeSEd Maste struct per_source_penalty *, const char *); 2219261079SEd Maste int srclimit_check_allow(int, int); 2319261079SEd Maste void srclimit_done(int); 240fdf8faeSEd Maste 250fdf8faeSEd Maste #define SRCLIMIT_PENALTY_NONE 0 260fdf8faeSEd Maste #define SRCLIMIT_PENALTY_CRASH 1 270fdf8faeSEd Maste #define SRCLIMIT_PENALTY_AUTHFAIL 2 280fdf8faeSEd Maste #define SRCLIMIT_PENALTY_GRACE_EXCEEDED 3 290fdf8faeSEd Maste #define SRCLIMIT_PENALTY_NOAUTH 4 30*3d9fd9fcSEd Maste #define SRCLIMIT_PENALTY_REFUSECONNECTION 5 310fdf8faeSEd Maste 320fdf8faeSEd Maste /* meaningful exit values, used by sshd listener for penalties */ 330fdf8faeSEd Maste #define EXIT_LOGIN_GRACE 3 /* login grace period exceeded */ 340fdf8faeSEd Maste #define EXIT_CHILD_CRASH 4 /* preauth child crashed */ 350fdf8faeSEd Maste #define EXIT_AUTH_ATTEMPTED 5 /* at least one auth attempt made */ 36*3d9fd9fcSEd Maste #define EXIT_CONFIG_REFUSED 6 /* sshd_config RefuseConnection */ 370fdf8faeSEd Maste 380fdf8faeSEd Maste void srclimit_penalise(struct xaddr *, int); 390fdf8faeSEd Maste int srclimit_penalty_check_allow(int, const char **); 400fdf8faeSEd Maste void srclimit_penalty_info(void); 41