Mercurial > thymian

annotate server/flood_check.cpp @ 0:a4671277546c tip

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
created the repository for the thymian project
author ferencd
date Tue, 17 Aug 2021 11:19:54 +0200
parents
children
rev   line source
ferencd@0 1 #include "flood_check.h"
ferencd@0 2
ferencd@0 3 #include <config.h>
ferencd@0 4
ferencd@0 5 #include <stdint.h>
ferencd@0 6 #include <log.h>
ferencd@0 7 #include <sstream>
ferencd@0 8
ferencd@0 9 std::mutex flood_check::locker;
ferencd@0 10
ferencd@0 11 std::map<std::time_t, flood_check::flood_map> flood_check::floods;
ferencd@0 12 std::map<std::string, flood_check::count_started> flood_check::hostd_flood;
ferencd@0 13 std::map<std::string, int> flood_check::suspension_times;
ferencd@0 14 std::map<std::string, std::time_t> flood_check::rejected_hosts;
ferencd@0 15
ferencd@0 16 void flood_check::attempt(std::string ip)
ferencd@0 17 {
ferencd@0 18 std::lock_guard<std::mutex> guard(locker);
ferencd@0 19
ferencd@0 20 std::chrono::time_point<std::chrono::system_clock> p2;
ferencd@0 21 p2 = std::chrono::system_clock::now();
ferencd@0 22 std::time_t c = std::chrono::duration_cast<std::chrono::seconds>(p2.time_since_epoch()).count();
ferencd@0 23 static std::time_t last_second = 0;
ferencd@0 24
ferencd@0 25 // see if this host is in the kicked out hosts map and if his sentence is still valid or not
ferencd@0 26 if(rejected_hosts.count(ip) > 0)
ferencd@0 27 {
ferencd@0 28 if(suspension_times.count(ip) > 0)
ferencd@0 29 {
ferencd@0 30 // sentence valid, kick him out
ferencd@0 31 auto timediff = std::difftime(rejected_hosts[ip], c);
ferencd@0 32 if(timediff <= suspension_times[ip] * config::instance().flood.default_suspension_time && timediff >= 0)
ferencd@0 33 {
ferencd@0 34 // debug() << "IP:" << ip << " still rejected for " << timediff << " seconds";
ferencd@0 35 // debug() << "LEAVE rejected throw";
ferencd@0 36
ferencd@0 37 throw std::runtime_error("rejected");
ferencd@0 38 }
ferencd@0 39 if(timediff < 0)
ferencd@0 40 {
ferencd@0 41 // sentence invalid, host has served ts sentence, however we are suspicious.
ferencd@0 42 if(abs(timediff) < 5) // if he tries again after 5 seconds of the expiration time
ferencd@0 43 {
ferencd@0 44 // kick him out again, with greater penalty
ferencd@0 45 rejected_hosts[ip] = c + ( ++suspension_times[ip] * config::instance().flood.default_suspension_time );
ferencd@0 46 // debug() << "IP:" << ip << " rejection increased for " << rejected_hosts[ip] - c << " seconds since it tried between " << abs(timediff) << " seconds";
ferencd@0 47 }
ferencd@0 48 else
ferencd@0 49 {
ferencd@0 50 // debug() << "IP:" << ip << " lifting rejection: timediff=" << abs(timediff);
ferencd@0 51 // let's hope his intentions are honest for now and forgive him by erasing his sin
ferencd@0 52 suspension_times.erase(ip);
ferencd@0 53 hostd_flood.erase(ip);
ferencd@0 54 rejected_hosts.erase(ip);
ferencd@0 55 }
ferencd@0 56 }
ferencd@0 57 else
ferencd@0 58 {
ferencd@0 59 // debug() << "IP:" << ip << " is strangely behaving: " << timediff << " seconds, rejecting regardless";
ferencd@0 60 throw std::runtime_error("rejected");
ferencd@0 61 }
ferencd@0 62 }
ferencd@0 63 else
ferencd@0 64 {
ferencd@0 65 // we shouldn't really be here
ferencd@0 66 log_critical() << "IP:" << ip << "has sentence, however no suspension counter";
ferencd@0 67 suspension_times.erase(ip);
ferencd@0 68 hostd_flood.erase(ip);
ferencd@0 69 rejected_hosts.erase(ip);
ferencd@0 70 }
ferencd@0 71 }
ferencd@0 72 else
ferencd@0 73 {
ferencd@0 74 // debug() << "IP:" << ip << " not in rejected_hosts";
ferencd@0 75 }
ferencd@0 76
ferencd@0 77 std::string key = std::to_string(static_cast<uint64_t>(c)) + "_" + ip;
ferencd@0 78
ferencd@0 79 if(floods.count(c) > 0)
ferencd@0 80 {
ferencd@0 81 flood_map& cfm = floods[c];
ferencd@0 82 if(cfm.count(key) > 0)
ferencd@0 83 {
ferencd@0 84 auto& flood_value = ++ cfm[key];
ferencd@0 85 // now check if flood_value > 100 and do something about it
ferencd@0 86 if(flood_value > config::instance().flood.max_offense_per_second)
ferencd@0 87 {
ferencd@0 88 debug() << "IP:" << ip << " tries to flood";
ferencd@0 89 if(hostd_flood.count(ip) > 0)
ferencd@0 90 {
ferencd@0 91 auto& flood_cnt = ++ hostd_flood[ip].count;
ferencd@0 92 debug() << "IP:" << ip << " tries to flood: " << flood_cnt;
ferencd@0 93
ferencd@0 94 if(flood_cnt > config::instance().flood.max_accepted_offenses)
ferencd@0 95 {
ferencd@0 96 auto tdiff = std::difftime(c, hostd_flood[ip].first_time);
ferencd@0 97 if(tdiff < config::instance().flood.max_offense_time)
ferencd@0 98 {
ferencd@0 99 // this host has tried to flood our system at least 10 times during the last minute, suspend him
ferencd@0 100 if(suspension_times.count(ip) > 0)
ferencd@0 101 {
ferencd@0 102 rejected_hosts.emplace(ip, c + ( ++suspension_times[ip] * config::instance().flood.default_suspension_time ));
ferencd@0 103 debug() << "IP:" << ip << " rejected for " << rejected_hosts[ip] - c << " seconds";
ferencd@0 104 }
ferencd@0 105 else
ferencd@0 106 {
ferencd@0 107 debug() << "IP:" << ip << "mandated for rejection since:" << suspension_times.count(ip);
ferencd@0 108 suspension_times.emplace(ip, 0);
ferencd@0 109 }
ferencd@0 110 }
ferencd@0 111 else
ferencd@0 112 {
ferencd@0 113 // first offence happened long time ago, time to set it up again, don't reset count since we don't like flooding us
ferencd@0 114 hostd_flood[ip].first_time = c;
ferencd@0 115 debug() << "IP:" << ip << " tries to flood but too long time has passed:" << tdiff;
ferencd@0 116 }
ferencd@0 117 }
ferencd@0 118 else
ferencd@0 119 {
ferencd@0 120 debug() << "IP:" << ip << " tries to flood but hasn't got enough flood_cnt: " << flood_cnt;
ferencd@0 121 }
ferencd@0 122 }
ferencd@0 123 else
ferencd@0 124 {
ferencd@0 125 hostd_flood.emplace(ip, count_started());
ferencd@0 126 }
ferencd@0 127 debug() << "LEAVE flood throw";
ferencd@0 128 throw std::runtime_error("flood");
ferencd@0 129 }
ferencd@0 130 }
ferencd@0 131 else
ferencd@0 132 {
ferencd@0 133 cfm[key] = 1;
ferencd@0 134 }
ferencd@0 135 }
ferencd@0 136 else
ferencd@0 137 {
ferencd@0 138 // create a new entry
ferencd@0 139 flood_map fm;
ferencd@0 140 fm[key] = 1;
ferencd@0 141 floods.emplace(c, fm);
ferencd@0 142 }
ferencd@0 143
ferencd@0 144 // just debug:
ferencd@0 145 for(const auto& k : rejected_hosts)
ferencd@0 146 {
ferencd@0 147 std::stringstream ss;
ferencd@0 148 ss << "rejected IP:" << k.first << " time:" << k.second - c;
ferencd@0 149 // debug() << ss.str();
ferencd@0 150 }
ferencd@0 151
ferencd@0 152 // now remove the previous seconds' attempts from the memory
ferencd@0 153 if(last_second != c)
ferencd@0 154 {
ferencd@0 155 if(floods.count(last_second) > 0)
ferencd@0 156 {
ferencd@0 157 floods.erase(last_second);
ferencd@0 158 }
ferencd@0 159 last_second = c;
ferencd@0 160 }
ferencd@0 161 }