1/*
2 * Copyright (c) 2020 Darren Tucker <dtucker@openbsd.org>
3 *
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
7 *
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 */
16
17#include "includes.h"
18
19#include <sys/socket.h>
20#include <sys/types.h>
21
22#include <limits.h>
23#include <netdb.h>
24#include <stdio.h>
25#include <string.h>
26
27#include "addr.h"
28#include "canohost.h"
29#include "log.h"
30#include "misc.h"
31#include "srclimit.h"
32#include "xmalloc.h"
33
34static int max_children, max_persource, ipv4_masklen, ipv6_masklen;
35
36/* Per connection state, used to enforce unauthenticated connection limit. */
37static struct child_info {
38	int id;
39	struct xaddr addr;
40} *child;
41
42void
43srclimit_init(int max, int persource, int ipv4len, int ipv6len)
44{
45	int i;
46
47	max_children = max;
48	ipv4_masklen = ipv4len;
49	ipv6_masklen = ipv6len;
50	max_persource = persource;
51	if (max_persource == INT_MAX)	/* no limit */
52		return;
53	debug("%s: max connections %d, per source %d, masks %d,%d", __func__,
54	    max, persource, ipv4len, ipv6len);
55	if (max <= 0)
56		fatal("%s: invalid number of sockets: %d", __func__, max);
57	child = xcalloc(max_children, sizeof(*child));
58	for (i = 0; i < max_children; i++)
59		child[i].id = -1;
60}
61
62/* returns 1 if connection allowed, 0 if not allowed. */
63int
64srclimit_check_allow(int sock, int id)
65{
66	struct xaddr xa, xb, xmask;
67	struct sockaddr_storage addr;
68	socklen_t addrlen = sizeof(addr);
69	struct sockaddr *sa = (struct sockaddr *)&addr;
70	int i, bits, first_unused, count = 0;
71	char xas[NI_MAXHOST];
72
73	if (max_persource == INT_MAX)	/* no limit */
74		return 1;
75
76	debug("%s: sock %d id %d limit %d", __func__, sock, id, max_persource);
77	if (getpeername(sock, sa, &addrlen) != 0)
78		return 1;	/* not remote socket? */
79	if (addr_sa_to_xaddr(sa, addrlen, &xa) != 0)
80		return 1;	/* unknown address family? */
81
82	/* Mask address off address to desired size. */
83	bits = xa.af == AF_INET ? ipv4_masklen : ipv6_masklen;
84	if (addr_netmask(xa.af, bits, &xmask) != 0 ||
85	    addr_and(&xb, &xa, &xmask) != 0) {
86		debug3("%s: invalid mask %d bits", __func__, bits);
87		return 1;
88	}
89
90	first_unused = max_children;
91	/* Count matching entries and find first unused one. */
92	for (i = 0; i < max_children; i++) {
93		if (child[i].id == -1) {
94			if (i < first_unused)
95				first_unused = i;
96		} else if (addr_cmp(&child[i].addr, &xb) == 0) {
97			count++;
98		}
99	}
100	if (addr_ntop(&xa, xas, sizeof(xas)) != 0) {
101		debug3("%s: addr ntop failed", __func__);
102		return 1;
103	}
104	debug3("%s: new unauthenticated connection from %s/%d, at %d of %d",
105	    __func__, xas, bits, count, max_persource);
106
107	if (first_unused == max_children) { /* no free slot found */
108		debug3("%s: no free slot", __func__);
109		return 0;
110	}
111	if (first_unused < 0 || first_unused >= max_children)
112		fatal("%s: internal error: first_unused out of range",
113		    __func__);
114
115	if (count >= max_persource)
116		return 0;
117
118	/* Connection allowed, store masked address. */
119	child[first_unused].id = id;
120	memcpy(&child[first_unused].addr, &xb, sizeof(xb));
121	return 1;
122}
123
124void
125srclimit_done(int id)
126{
127	int i;
128
129	if (max_persource == INT_MAX)	/* no limit */
130		return;
131
132	debug("%s: id %d", __func__, id);
133	/* Clear corresponding state entry. */
134	for (i = 0; i < max_children; i++) {
135		if (child[i].id == id) {
136			child[i].id = -1;
137			return;
138		}
139	}
140}
141