Mercurial > thymian

comparison server/flood_check.cpp @ 0:a4671277546c tip

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
created the repository for the thymian project
author ferencd
date Tue, 17 Aug 2021 11:19:54 +0200
parents
children
comparison
equal deleted inserted replaced
-1:000000000000 0:a4671277546c
1 #include "flood_check.h"
2
3 #include <config.h>
4
5 #include <stdint.h>
6 #include <log.h>
7 #include <sstream>
8
9 std::mutex flood_check::locker;
10
11 std::map<std::time_t, flood_check::flood_map> flood_check::floods;
12 std::map<std::string, flood_check::count_started> flood_check::hostd_flood;
13 std::map<std::string, int> flood_check::suspension_times;
14 std::map<std::string, std::time_t> flood_check::rejected_hosts;
15
16 void flood_check::attempt(std::string ip)
17 {
18 std::lock_guard<std::mutex> guard(locker);
19
20 std::chrono::time_point<std::chrono::system_clock> p2;
21 p2 = std::chrono::system_clock::now();
22 std::time_t c = std::chrono::duration_cast<std::chrono::seconds>(p2.time_since_epoch()).count();
23 static std::time_t last_second = 0;
24
25 // see if this host is in the kicked out hosts map and if his sentence is still valid or not
26 if(rejected_hosts.count(ip) > 0)
27 {
28 if(suspension_times.count(ip) > 0)
29 {
30 // sentence valid, kick him out
31 auto timediff = std::difftime(rejected_hosts[ip], c);
32 if(timediff <= suspension_times[ip] * config::instance().flood.default_suspension_time && timediff >= 0)
33 {
34 // debug() << "IP:" << ip << " still rejected for " << timediff << " seconds";
35 // debug() << "LEAVE rejected throw";
36
37 throw std::runtime_error("rejected");
38 }
39 if(timediff < 0)
40 {
41 // sentence invalid, host has served ts sentence, however we are suspicious.
42 if(abs(timediff) < 5) // if he tries again after 5 seconds of the expiration time
43 {
44 // kick him out again, with greater penalty
45 rejected_hosts[ip] = c + ( ++suspension_times[ip] * config::instance().flood.default_suspension_time );
46 // debug() << "IP:" << ip << " rejection increased for " << rejected_hosts[ip] - c << " seconds since it tried between " << abs(timediff) << " seconds";
47 }
48 else
49 {
50 // debug() << "IP:" << ip << " lifting rejection: timediff=" << abs(timediff);
51 // let's hope his intentions are honest for now and forgive him by erasing his sin
52 suspension_times.erase(ip);
53 hostd_flood.erase(ip);
54 rejected_hosts.erase(ip);
55 }
56 }
57 else
58 {
59 // debug() << "IP:" << ip << " is strangely behaving: " << timediff << " seconds, rejecting regardless";
60 throw std::runtime_error("rejected");
61 }
62 }
63 else
64 {
65 // we shouldn't really be here
66 log_critical() << "IP:" << ip << "has sentence, however no suspension counter";
67 suspension_times.erase(ip);
68 hostd_flood.erase(ip);
69 rejected_hosts.erase(ip);
70 }
71 }
72 else
73 {
74 // debug() << "IP:" << ip << " not in rejected_hosts";
75 }
76
77 std::string key = std::to_string(static_cast<uint64_t>(c)) + "_" + ip;
78
79 if(floods.count(c) > 0)
80 {
81 flood_map& cfm = floods[c];
82 if(cfm.count(key) > 0)
83 {
84 auto& flood_value = ++ cfm[key];
85 // now check if flood_value > 100 and do something about it
86 if(flood_value > config::instance().flood.max_offense_per_second)
87 {
88 debug() << "IP:" << ip << " tries to flood";
89 if(hostd_flood.count(ip) > 0)
90 {
91 auto& flood_cnt = ++ hostd_flood[ip].count;
92 debug() << "IP:" << ip << " tries to flood: " << flood_cnt;
93
94 if(flood_cnt > config::instance().flood.max_accepted_offenses)
95 {
96 auto tdiff = std::difftime(c, hostd_flood[ip].first_time);
97 if(tdiff < config::instance().flood.max_offense_time)
98 {
99 // this host has tried to flood our system at least 10 times during the last minute, suspend him
100 if(suspension_times.count(ip) > 0)
101 {
102 rejected_hosts.emplace(ip, c + ( ++suspension_times[ip] * config::instance().flood.default_suspension_time ));
103 debug() << "IP:" << ip << " rejected for " << rejected_hosts[ip] - c << " seconds";
104 }
105 else
106 {
107 debug() << "IP:" << ip << "mandated for rejection since:" << suspension_times.count(ip);
108 suspension_times.emplace(ip, 0);
109 }
110 }
111 else
112 {
113 // first offence happened long time ago, time to set it up again, don't reset count since we don't like flooding us
114 hostd_flood[ip].first_time = c;
115 debug() << "IP:" << ip << " tries to flood but too long time has passed:" << tdiff;
116 }
117 }
118 else
119 {
120 debug() << "IP:" << ip << " tries to flood but hasn't got enough flood_cnt: " << flood_cnt;
121 }
122 }
123 else
124 {
125 hostd_flood.emplace(ip, count_started());
126 }
127 debug() << "LEAVE flood throw";
128 throw std::runtime_error("flood");
129 }
130 }
131 else
132 {
133 cfm[key] = 1;
134 }
135 }
136 else
137 {
138 // create a new entry
139 flood_map fm;
140 fm[key] = 1;
141 floods.emplace(c, fm);
142 }
143
144 // just debug:
145 for(const auto& k : rejected_hosts)
146 {
147 std::stringstream ss;
148 ss << "rejected IP:" << k.first << " time:" << k.second - c;
149 // debug() << ss.str();
150 }
151
152 // now remove the previous seconds' attempts from the memory
153 if(last_second != c)
154 {
155 if(floods.count(last_second) > 0)
156 {
157 floods.erase(last_second);
158 }
159 last_second = c;
160 }
161 }