1N/A/*
1N/A * Copyright (c) 2003 Sendmail, Inc. and its suppliers.
1N/A * All rights reserved.
1N/A *
1N/A * By using this file, you agree to the terms and conditions set
1N/A * forth in the LICENSE file which can be found at the top level of
1N/A * the sendmail distribution.
1N/A *
1N/A * Contributed by Jose Marcio Martins da Cruz - Ecole des Mines de Paris
1N/A * Jose-Marcio.Martins@ensmp.fr
1N/A */
1N/A
1N/A/* a part of this code is based on inetd.c for which this copyright applies: */
1N/A/*
1N/A * Copyright (c) 1983, 1991, 1993, 1994
1N/A * The Regents of the University of California. All rights reserved.
1N/A *
1N/A * Redistribution and use in source and binary forms, with or without
1N/A * modification, are permitted provided that the following conditions
1N/A * are met:
1N/A * 1. Redistributions of source code must retain the above copyright
1N/A * notice, this list of conditions and the following disclaimer.
1N/A * 2. Redistributions in binary form must reproduce the above copyright
1N/A * notice, this list of conditions and the following disclaimer in the
1N/A * documentation and/or other materials provided with the distribution.
1N/A * 3. All advertising materials mentioning features or use of this software
1N/A * must display the following acknowledgement:
1N/A * This product includes software developed by the University of
1N/A * California, Berkeley and its contributors.
1N/A * 4. Neither the name of the University nor the names of its contributors
1N/A * may be used to endorse or promote products derived from this software
1N/A * without specific prior written permission.
1N/A *
1N/A * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
1N/A * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
1N/A * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
1N/A * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
1N/A * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
1N/A * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
1N/A * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1N/A * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
1N/A * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
1N/A * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
1N/A * SUCH DAMAGE.
1N/A */
1N/A
1N/A#include <sendmail.h>
1N/ASM_RCSID("@(#)$Id: ratectrl.c,v 8.13 2009/05/05 23:19:34 ca Exp $")
1N/A
1N/A/*
1N/A** stuff included - given some warnings (inet_ntoa)
1N/A** - surely not everything is needed
1N/A*/
1N/A
1N/A#if NETINET || NETINET6
1N/A# include <arpa/inet.h>
1N/A#endif /* NETINET || NETINET6 */
1N/A
1N/A#include <sm/time.h>
1N/A
1N/A#ifndef HASH_ALG
1N/A# define HASH_ALG 2
1N/A#endif /* HASH_ALG */
1N/A
1N/A#ifndef RATECTL_DEBUG
1N/A# define RATECTL_DEBUG 0
1N/A#endif /* RATECTL_DEBUG */
1N/A
1N/A/* forward declarations */
1N/Astatic int client_rate __P((time_t, SOCKADDR *, bool));
1N/Astatic int total_rate __P((time_t, bool));
1N/A
1N/A/*
1N/A** CONNECTION_RATE_CHECK - updates connection history data
1N/A** and computes connection rate for the given host
1N/A**
1N/A** Parameters:
1N/A** hostaddr -- ip address of smtp client
1N/A** e -- envelope
1N/A**
1N/A** Returns:
1N/A** true (always)
1N/A**
1N/A** Side Effects:
1N/A** updates connection history
1N/A**
1N/A** Warnings:
1N/A** For each connection, this call shall be
1N/A** done only once with the value true for the
1N/A** update parameter.
1N/A** Typically, this call is done with the value
1N/A** true by the father, and once again with
1N/A** the value false by the children.
1N/A**
1N/A*/
1N/A
1N/Abool
1N/Aconnection_rate_check(hostaddr, e)
1N/A SOCKADDR *hostaddr;
1N/A ENVELOPE *e;
1N/A{
1N/A time_t now;
1N/A int totalrate, clientrate;
1N/A static int clientconn = 0;
1N/A
1N/A now = time(NULL);
1N/A#if RATECTL_DEBUG
1N/A sm_syslog(LOG_INFO, NOQID, "connection_rate_check entering...");
1N/A#endif /* RATECTL_DEBUG */
1N/A
1N/A /* update server connection rate */
1N/A totalrate = total_rate(now, e == NULL);
1N/A#if RATECTL_DEBUG
1N/A sm_syslog(LOG_INFO, NOQID, "global connection rate: %d", totalrate);
1N/A#endif /* RATECTL_DEBUG */
1N/A
1N/A /* update client connection rate */
1N/A clientrate = client_rate(now, hostaddr, e == NULL);
1N/A
1N/A if (e == NULL)
1N/A clientconn = count_open_connections(hostaddr);
1N/A
1N/A if (e != NULL)
1N/A {
1N/A char s[16];
1N/A
1N/A sm_snprintf(s, sizeof(s), "%d", clientrate);
1N/A macdefine(&e->e_macro, A_TEMP, macid("{client_rate}"), s);
1N/A sm_snprintf(s, sizeof(s), "%d", totalrate);
1N/A macdefine(&e->e_macro, A_TEMP, macid("{total_rate}"), s);
1N/A sm_snprintf(s, sizeof(s), "%d", clientconn);
1N/A macdefine(&e->e_macro, A_TEMP, macid("{client_connections}"),
1N/A s);
1N/A }
1N/A return true;
1N/A}
1N/A
1N/A/*
1N/A** Data declarations needed to evaluate connection rate
1N/A*/
1N/A
1N/Astatic int CollTime = 60;
1N/A
1N/A/* this should be a power of 2, otherwise CPMHMASK doesn't work well */
1N/A#ifndef CPMHSIZE
1N/A# define CPMHSIZE 1024
1N/A#endif /* CPMHSIZE */
1N/A
1N/A#define CPMHMASK (CPMHSIZE-1)
1N/A
1N/A#ifndef MAX_CT_STEPS
1N/A# define MAX_CT_STEPS 10
1N/A#endif /* MAX_CT_STEPS */
1N/A
1N/A/*
1N/A** time granularity: 10s (that's one "tick")
1N/A** will be initialised to ConnectionRateWindowSize/CHTSIZE
1N/A** before being used the first time
1N/A*/
1N/A
1N/Astatic int ChtGran = -1;
1N/A
1N/A#define CHTSIZE 6
1N/A
1N/A/* Number of connections for a certain "tick" */
1N/Atypedef struct CTime
1N/A{
1N/A unsigned long ct_Ticks;
1N/A int ct_Count;
1N/A}
1N/ACTime_T;
1N/A
1N/Atypedef struct CHash
1N/A{
1N/A#if NETINET6 && NETINET
1N/A union
1N/A {
1N/A struct in_addr c4_Addr;
1N/A struct in6_addr c6_Addr;
1N/A } cu_Addr;
1N/A# define ch_Addr4 cu_Addr.c4_Addr
1N/A# define ch_Addr6 cu_Addr.c6_Addr
1N/A#else /* NETINET6 && NETINET */
1N/A# if NETINET6
1N/A struct in6_addr ch_Addr;
1N/A# define ch_Addr6 ch_Addr
1N/A# else /* NETINET6 */
1N/A struct in_addr ch_Addr;
1N/A# define ch_Addr4 ch_Addr
1N/A# endif /* NETINET6 */
1N/A#endif /* NETINET6 && NETINET */
1N/A
1N/A int ch_Family;
1N/A time_t ch_LTime;
1N/A unsigned long ch_colls;
1N/A
1N/A /* 6 buckets for ticks: 60s */
1N/A CTime_T ch_Times[CHTSIZE];
1N/A}
1N/ACHash_T;
1N/A
1N/Astatic CHash_T CHashAry[CPMHSIZE];
1N/Astatic bool CHashAryOK = false;
1N/A
1N/A/*
1N/A** CLIENT_RATE - Evaluate connection rate per smtp client
1N/A**
1N/A** Parameters:
1N/A** now - current time in secs
1N/A** saddr - client address
1N/A** update - update data / check only
1N/A**
1N/A** Returns:
1N/A** connection rate (connections / ConnectionRateWindowSize)
1N/A**
1N/A** Side effects:
1N/A** update static global data
1N/A**
1N/A*/
1N/A
1N/Astatic int
1N/Aclient_rate(now, saddr, update)
1N/A time_t now;
1N/A SOCKADDR *saddr;
1N/A bool update;
1N/A{
1N/A unsigned int hv;
1N/A int i;
1N/A int cnt;
1N/A bool coll;
1N/A CHash_T *chBest = NULL;
1N/A unsigned int ticks;
1N/A
1N/A cnt = 0;
1N/A hv = 0xABC3D20F;
1N/A if (ChtGran < 0)
1N/A ChtGran = ConnectionRateWindowSize / CHTSIZE;
1N/A if (ChtGran <= 0)
1N/A ChtGran = 10;
1N/A
1N/A ticks = now / ChtGran;
1N/A
1N/A if (!CHashAryOK)
1N/A {
1N/A memset(CHashAry, 0, sizeof(CHashAry));
1N/A CHashAryOK = true;
1N/A }
1N/A
1N/A {
1N/A char *p;
1N/A int addrlen;
1N/A#if HASH_ALG != 1
1N/A int c, d;
1N/A#endif /* HASH_ALG != 1 */
1N/A
1N/A switch (saddr->sa.sa_family)
1N/A {
1N/A#if NETINET
1N/A case AF_INET:
1N/A p = (char *)&saddr->sin.sin_addr;
1N/A addrlen = sizeof(struct in_addr);
1N/A break;
1N/A#endif /* NETINET */
1N/A#if NETINET6
1N/A case AF_INET6:
1N/A p = (char *)&saddr->sin6.sin6_addr;
1N/A addrlen = sizeof(struct in6_addr);
1N/A break;
1N/A#endif /* NETINET6 */
1N/A default:
1N/A /* should not happen */
1N/A return -1;
1N/A }
1N/A
1N/A /* compute hash value */
1N/A for (i = 0; i < addrlen; ++i, ++p)
1N/A#if HASH_ALG == 1
1N/A hv = (hv << 5) ^ (hv >> 23) ^ *p;
1N/A hv = (hv ^ (hv >> 16));
1N/A#elif HASH_ALG == 2
1N/A {
1N/A d = *p;
1N/A c = d;
1N/A c ^= c<<6;
1N/A hv += (c<<11) ^ (c>>1);
1N/A hv ^= (d<<14) + (d<<7) + (d<<4) + d;
1N/A }
1N/A#elif HASH_ALG == 3
1N/A {
1N/A hv = (hv << 4) + *p;
1N/A d = hv & 0xf0000000;
1N/A if (d != 0)
1N/A {
1N/A hv ^= (d >> 24);
1N/A hv ^= d;
1N/A }
1N/A }
1N/A#else /* HASH_ALG == 1 */
1N/A hv = ((hv << 1) ^ (*p & 0377)) % cctx->cc_size;
1N/A#endif /* HASH_ALG == 1 */
1N/A }
1N/A
1N/A coll = true;
1N/A for (i = 0; i < MAX_CT_STEPS; ++i)
1N/A {
1N/A CHash_T *ch = &CHashAry[(hv + i) & CPMHMASK];
1N/A
1N/A#if NETINET
1N/A if (saddr->sa.sa_family == AF_INET &&
1N/A ch->ch_Family == AF_INET &&
1N/A (saddr->sin.sin_addr.s_addr == ch->ch_Addr4.s_addr ||
1N/A ch->ch_Addr4.s_addr == 0))
1N/A {
1N/A chBest = ch;
1N/A coll = false;
1N/A break;
1N/A }
1N/A#endif /* NETINET */
1N/A#if NETINET6
1N/A if (saddr->sa.sa_family == AF_INET6 &&
1N/A ch->ch_Family == AF_INET6 &&
1N/A (IN6_ARE_ADDR_EQUAL(&saddr->sin6.sin6_addr,
1N/A &ch->ch_Addr6) != 0 ||
1N/A IN6_IS_ADDR_UNSPECIFIED(&ch->ch_Addr6)))
1N/A {
1N/A chBest = ch;
1N/A coll = false;
1N/A break;
1N/A }
1N/A#endif /* NETINET6 */
1N/A if (chBest == NULL || ch->ch_LTime == 0 ||
1N/A ch->ch_LTime < chBest->ch_LTime)
1N/A chBest = ch;
1N/A }
1N/A
1N/A /* Let's update data... */
1N/A if (update)
1N/A {
1N/A if (coll && (now - chBest->ch_LTime < CollTime))
1N/A {
1N/A /*
1N/A ** increment the number of collisions last
1N/A ** CollTime for this client
1N/A */
1N/A
1N/A chBest->ch_colls++;
1N/A
1N/A /*
1N/A ** Maybe shall log if collision rate is too high...
1N/A ** and take measures to resize tables
1N/A ** if this is the case
1N/A */
1N/A }
1N/A
1N/A /*
1N/A ** If it's not a match, then replace the data.
1N/A ** Note: this purges the history of a colliding entry,
1N/A ** which may cause "overruns", i.e., if two entries are
1N/A ** "cancelling" each other out, then they may exceed
1N/A ** the limits that are set. This might be mitigated a bit
1N/A ** by the above "best of 5" function however.
1N/A **
1N/A ** Alternative approach: just use the old data, which may
1N/A ** cause false positives however.
1N/A ** To activate this, change deactivate following memset call.
1N/A */
1N/A
1N/A if (coll)
1N/A {
1N/A#if NETINET
1N/A if (saddr->sa.sa_family == AF_INET)
1N/A {
1N/A chBest->ch_Family = AF_INET;
1N/A chBest->ch_Addr4 = saddr->sin.sin_addr;
1N/A }
1N/A#endif /* NETINET */
1N/A#if NETINET6
1N/A if (saddr->sa.sa_family == AF_INET6)
1N/A {
1N/A chBest->ch_Family = AF_INET6;
1N/A chBest->ch_Addr6 = saddr->sin6.sin6_addr;
1N/A }
1N/A#endif /* NETINET6 */
1N/A#if 1
1N/A memset(chBest->ch_Times, '\0',
1N/A sizeof(chBest->ch_Times));
1N/A#endif /* 1 */
1N/A }
1N/A
1N/A chBest->ch_LTime = now;
1N/A {
1N/A CTime_T *ct = &chBest->ch_Times[ticks % CHTSIZE];
1N/A
1N/A if (ct->ct_Ticks != ticks)
1N/A {
1N/A ct->ct_Ticks = ticks;
1N/A ct->ct_Count = 0;
1N/A }
1N/A ++ct->ct_Count;
1N/A }
1N/A }
1N/A
1N/A /* Now let's count connections on the window */
1N/A for (i = 0; i < CHTSIZE; ++i)
1N/A {
1N/A CTime_T *ct = &chBest->ch_Times[i];
1N/A
1N/A if (ct->ct_Ticks <= ticks && ct->ct_Ticks >= ticks - CHTSIZE)
1N/A cnt += ct->ct_Count;
1N/A }
1N/A
1N/A#if RATECTL_DEBUG
1N/A sm_syslog(LOG_WARNING, NOQID,
1N/A "cln: cnt=(%d), CHTSIZE=(%d), ChtGran=(%d)",
1N/A cnt, CHTSIZE, ChtGran);
1N/A#endif /* RATECTL_DEBUG */
1N/A return cnt;
1N/A}
1N/A
1N/A/*
1N/A** TOTAL_RATE - Evaluate global connection rate
1N/A**
1N/A** Parameters:
1N/A** now - current time in secs
1N/A** update - update data / check only
1N/A**
1N/A** Returns:
1N/A** connection rate (connections / ConnectionRateWindowSize)
1N/A*/
1N/A
1N/Astatic CTime_T srv_Times[CHTSIZE];
1N/Astatic bool srv_Times_OK = false;
1N/A
1N/Astatic int
1N/Atotal_rate(now, update)
1N/A time_t now;
1N/A bool update;
1N/A{
1N/A int i;
1N/A int cnt = 0;
1N/A CTime_T *ct;
1N/A unsigned int ticks;
1N/A
1N/A if (ChtGran < 0)
1N/A ChtGran = ConnectionRateWindowSize / CHTSIZE;
1N/A if (ChtGran == 0)
1N/A ChtGran = 10;
1N/A ticks = now / ChtGran;
1N/A if (!srv_Times_OK)
1N/A {
1N/A memset(srv_Times, 0, sizeof(srv_Times));
1N/A srv_Times_OK = true;
1N/A }
1N/A
1N/A /* Let's update data */
1N/A if (update)
1N/A {
1N/A ct = &srv_Times[ticks % CHTSIZE];
1N/A
1N/A if (ct->ct_Ticks != ticks)
1N/A {
1N/A ct->ct_Ticks = ticks;
1N/A ct->ct_Count = 0;
1N/A }
1N/A ++ct->ct_Count;
1N/A }
1N/A
1N/A /* Let's count connections on the window */
1N/A for (i = 0; i < CHTSIZE; ++i)
1N/A {
1N/A ct = &srv_Times[i];
1N/A
1N/A if (ct->ct_Ticks <= ticks && ct->ct_Ticks >= ticks - CHTSIZE)
1N/A cnt += ct->ct_Count;
1N/A }
1N/A
1N/A#if RATECTL_DEBUG
1N/A sm_syslog(LOG_WARNING, NOQID,
1N/A "srv: cnt=(%d), CHTSIZE=(%d), ChtGran=(%d)",
1N/A cnt, CHTSIZE, ChtGran);
1N/A#endif /* RATECTL_DEBUG */
1N/A
1N/A return cnt;
1N/A}