Mercurial > syslog2iptables

comparison src/syslogconfig.cpp @ 63:60f59936fabb

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
good authentication prevents ip blocking for awhile
author Carl Byington <carl@five-ten-sg.com>
date Sat, 19 Dec 2015 10:12:24 -0800
parents f133196b8591
children 0e736950a117
comparison
equal deleted inserted replaced
62:c30df5975c49 63:60f59936fabb
62 } 62 }
63 63
64 64
65 void IPR::add(int ip, int amount, CONTEXT &con, const char *file_name, int pattern_index, const char *message) { 65 void IPR::add(int ip, int amount, CONTEXT &con, const char *file_name, int pattern_index, const char *message) {
66 if (con.looking(ip)) { 66 if (con.looking(ip)) {
67 ip_buckets::iterator j = repeat_offenders.find(ip); 67 if (amount > 0) {
68 int scale = (j == repeat_offenders.end()) ? 1 : (*j).second.count; 68 ip_buckets::iterator j = repeat_offenders.find(ip);
69 amount *= scale; 69 int scale = (j == repeat_offenders.end()) ? 1 : (*j).second.count;
70 70 amount *= scale;
71 ip_buckets::iterator i = violations.find(ip); 71
72 if (i == violations.end()) { 72 ip_buckets::iterator i = violations.find(ip);
73 bucket b; 73 if (i == violations.end()) {
74 b.count = amount; 74 bucket b;
75 b.blocked = (con.get_threshold() <= b.count); 75 b.count = amount;
76 violations[ip] = b; 76 b.blocked = (con.get_threshold() <= b.count);
77 if (b.blocked) { 77 violations[ip] = b;
78 update(ip, true, scale, file_name, pattern_index, message); 78 if (b.blocked) {
79 changed(con, ip, true);
80 }
81 }
82 else {
83 bucket &b = (*i).second;
84 if (b.count < (INT_MAX-amount)) {
85 b.count += amount;
86 if ((!b.blocked) && (con.get_threshold() <= b.count)) {
87 b.blocked = true;
88 update(ip, true, scale, file_name, pattern_index, message); 79 update(ip, true, scale, file_name, pattern_index, message);
89 changed(con, ip, true); 80 changed(con, ip, true);
81 }
82 }
83 else {
84 bucket &b = (*i).second;
85 if ((b.count >= 0) && (b.count < 2600000)) {
86 // good authentication (count<0) prevents blocking
87 // not much point in blocking for more than a month
88 b.count += amount;
89 if ((!b.blocked) && (con.get_threshold() <= b.count)) {
90 b.blocked = true;
91 update(ip, true, scale, file_name, pattern_index, message);
92 changed(con, ip, true);
93 }
94 }
95 }
96 }
97
98 else { // amount < 0
99 char buf[maxlen];
100 in_addr ad;
101 ad.s_addr = htonl(ip);
102 snprintf(buf, maxlen, "%s for %s", message, inet_ntoa(ad));
103 my_syslog(buf);
104
105 ip_buckets::iterator j = repeat_offenders.find(ip);
106 if (j != repeat_offenders.end()) {
107 repeat_offenders.erase(j++);
108 snprintf(buf, maxlen, "removing %s from repeat offenders", inet_ntoa(ad));
109 my_syslog(buf);
110 }
111 ip_buckets::iterator i = violations.find(ip);
112 if (i == violations.end()) {
113 bucket b;
114 b.count = amount;
115 b.blocked = false;
116 violations[ip] = b;
117 }
118 else {
119 bucket &b = (*i).second;
120 b.count = amount;
121 if (b.blocked) {
122 update(ip, false, 0, NULL, 0, NULL);
123 changed(con, ip, false);
90 } 124 }
91 } 125 }
92 } 126 }
93 } 127 }
94 } 128 }
96 130
97 void IPR::leak(int amount, CONTEXT &con) { 131 void IPR::leak(int amount, CONTEXT &con) {
98 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); ) { 132 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); ) {
99 int ip = (*i).first; 133 int ip = (*i).first;
100 bucket &b = (*i).second; 134 bucket &b = (*i).second;
101 if (b.count <= amount) { 135 if (b.count < 0) {
102 if (b.blocked) { 136 if (b.count >= -amount) violations.erase(i++);
103 update(ip, false, 0, NULL, 0, NULL); 137 else {
104 changed(con, ip, false); 138 b.count += amount;
105 } 139 i++;
106 violations.erase(i++); 140 }
107 } 141 }
108 else { 142 else {
109 b.count -= amount; 143 if (b.count <= amount) {
110 i++; 144 if (b.blocked) {
145 update(ip, false, 0, NULL, 0, NULL);
146 changed(con, ip, false);
147 }
148 violations.erase(i++);
149 }
150 else {
151 b.count -= amount;
152 i++;
153 }
111 } 154 }
112 } 155 }
113 daily_timer -= amount; 156 daily_timer -= amount;
114 if (daily_timer < 0) { 157 if (daily_timer < 0) {
115 daily_timer = 86400; 158 daily_timer = 86400;