New state logic, which uses a per-culprit timer

LibUCW timers are light enough for this and it saves a lot of
bookkeepin inside bouncer.

diff --git a/bouncer.c b/bouncer.c
index a86bafd9e22a6a66af38697ea582dc29353e35a2..03e739cde31afd8a101582dfea19b6a3021e8397 100644 (file)
--- a/bouncer.c
+++ b/bouncer.c
@@ -88,27 +88,31 @@ static bool addr_parse(struct addr *addr, const char *src)
 
 static char *listen_on = "/var/run/bouncer.sock";
 static uns max_failures = ~0U;
 
 static char *listen_on = "/var/run/bouncer.sock";
 static uns max_failures = ~0U;

-static uns max_suspect_time = 86400;
+static uns suspect_time = 86400;
+static uns banned_time = 86400;
+static uns max_probation = ~0U;
+static double banned_again_coeff = 2;

 static uns max_banned_time = 86400;
 static uns max_banned_time = 86400;

-static uns max_suspects = ~0U;
-static uns max_banned = ~0U;
-static uns probation;
+static uns probation_time = 86400;
+static uns max_culprits = ~0U;
+static char *config_log_stream;

 static char *ipv4_set;
 static char *ipv6_set;
 static char *ipv4_set;
 static char *ipv6_set;

-static char *config_log_stream;

 
 static struct cf_section bouncer_cf = {
   CF_ITEMS {
     CF_STRING("ListenOn", &listen_on),
 
 static struct cf_section bouncer_cf = {
   CF_ITEMS {
     CF_STRING("ListenOn", &listen_on),

-    CF_UNS("MaxSuspects", &max_suspects),
-    CF_UNS("MaxBanned", &max_banned),
-    CF_UNS("MaxSuspectTime", &max_suspect_time),
-    CF_UNS("MaxBannedTime", &max_banned_time),

     CF_UNS("MaxFailures", &max_failures),
     CF_UNS("MaxFailures", &max_failures),

-    CF_UNS("Probation", &probation),
+    CF_UNS("SuspectTime", &suspect_time),
+    CF_UNS("BannedTime", &banned_time),
+    CF_UNS("MaxProbation", &max_probation),
+    CF_DOUBLE("BannedAgainCoeff", &banned_again_coeff),
+    CF_UNS("MaxBannedTime", &max_banned_time),
+    CF_UNS("ProbationTime", &probation_time),
+    CF_UNS("MaxCulprits", &max_culprits),
+    CF_STRING("LogStream", &config_log_stream),

     CF_STRING("IPv4Set", &ipv4_set),
     CF_STRING("IPv6Set", &ipv6_set),
     CF_STRING("IPv4Set", &ipv4_set),
     CF_STRING("IPv6Set", &ipv6_set),

-    CF_STRING("LogStream", &config_log_stream),

     CF_END
   }
 };
     CF_END
   }
 };


@@ -216,147 +220,143 @@ static bool is_modify(bool add, struct addr addr)
 
 /*** Handling of login failures ***/
 
 
 /*** Handling of login failures ***/
 

-struct culprit_node {
-  cnode n;                     // In either suspect_list or banned_list
+enum culprit_state {
+  STATE_INVALID,
+  STATE_SUSPECT,
+  STATE_BANNED,
+  STATE_PROBATION,
+};
+
+static const char * const culprit_states[] = {
+  "invalid",
+  "suspect",
+  "banned",
+  "probation",
+};
+
+struct culprit {

   union {
     struct addr addr;
     byte addr_bytes[16];
   };
   union {
     struct addr addr;
     byte addr_bytes[16];
   };

+  enum culprit_state state;

   uns fail_count;
   uns fail_count;

-  bool banned;
-  timestamp_t last_fail;       // Not updated when banned
+  uns sentence_count;
+  uns ban_time;
+  struct main_timer timer;

 };
 
 };
 

-#define HASH_NODE struct culprit_node
-#define HASH_PREFIX(x) culprit_##x
+static uns num_culprits;
+static void culprit_timer(struct main_timer *tm);
+
+static void culprit_hash_init_data(struct culprit *c)
+{
+  c->state = STATE_SUSPECT;
+  c->fail_count = 0;
+  bzero(&c->timer, sizeof(c->timer));
+  c->timer.handler = culprit_timer;
+  c->timer.data = c;
+  num_culprits++;
+}
+
+#define HASH_NODE struct culprit
+#define HASH_PREFIX(x) culprit_hash_##x

 #define HASH_KEY_MEMORY addr_bytes
 #define HASH_KEY_SIZE 16
 #define HASH_KEY_MEMORY addr_bytes
 #define HASH_KEY_SIZE 16

+#define HASH_GIVE_INIT_DATA

 #define HASH_WANT_LOOKUP
 #define HASH_WANT_REMOVE
 #define HASH_USE_AUTO_ELTPOOL 1000
 #define HASH_ZERO_FILL
 #define HASH_WANT_LOOKUP
 #define HASH_WANT_REMOVE
 #define HASH_USE_AUTO_ELTPOOL 1000
 #define HASH_ZERO_FILL

-#define HASH_LOOKUP_DETECT_NEW

 #include <ucw/hashtable.h>
 
 #include <ucw/hashtable.h>
 

-static clist suspect_list, banned_list;
-static uns num_suspects, num_banned;
-static struct main_timer cleanup_timer;
+static void culprit_delete(struct culprit *c)
+{
+  timer_del(&c->timer);
+  culprit_hash_remove(c);
+  num_culprits--;
+}

 
 

-static void cleanup_list(clist *list, uns *counter, timestamp_t max_time, uns max_count, timestamp_t *next)
+static void culprit_set_state(struct culprit *c, enum culprit_state state, uns timeout)

 {
 {

-  timestamp_t now = main_get_now();
+  c->state = state;
+  timer_add_rel(&c->timer, (timestamp_t)timeout * 1000);
+  msg(L_DEBUG, "Suspect %s: state=%s failures=%u timeout=%u", AFMT(c->addr), culprit_states[state], c->fail_count, timeout);
+}

 
 

-  for (;;)
-    {
-      struct culprit_node *c = clist_head(list);
-      if (!c)
-       break;
+static void handle_failed_login(struct addr addr, int cnt)
+{
+  timestamp_t now = main_get_now();

 
 

-      timestamp_t expire_in = c->last_fail + max_time;
-      if (*counter > max_count)
-       {
-         static timestamp_t last_overflow_warning;
-         if (last_overflow_warning + 60000 < now)
-           {
-             last_overflow_warning = now;
-             if (c->banned)
-               msg(L_WARN, "Too many bans, dropping some. Try increasing MaxBanned.");
-             else
-               msg(L_WARN, "Too many suspects, dropping some. Try increasing MaxSuspects.");
-           }
-         expire_in = 0;
-       }
+  struct culprit *c = culprit_hash_lookup((byte *) &addr);

 
 

-      if (expire_in > now)
+  if (num_culprits > max_culprits)
+    {
+      // This can happen only when this lookup created a new culprit.
+      static timestamp_t last_overflow_warning;
+      if (last_overflow_warning + 60000 < now)

        {
        {

-         *next = MIN(*next, expire_in);
-         break;
+         last_overflow_warning = now;
+         msg(L_WARN, "Too many culprits, dropping some. Try increasing MaxCulprits.");
+         culprit_delete(c);
+         return;

        }
        }

+    }

 
 

-      clist_remove(&c->n);
-      (*counter)--;
-
-      if (c->banned)
+  switch (c->state)
+    {
+    case STATE_SUSPECT:
+      c->fail_count += cnt;
+      if (c->fail_count > max_failures)

        {
        {

-         msg(L_INFO, "Unbanning %s", AFMT(c->addr));
-         is_modify(0, c->addr);
-         if (probation)
-           {
-             c->banned = 0;
-             c->last_fail = now;
-             c->fail_count = max_failures - probation;
-             clist_add_tail(&suspect_list, &c->n);
-             num_suspects++;
-             msg(L_DEBUG, "Suspect %s: probation, failures=%u", AFMT(c->addr), c->fail_count);
-           }
-         else
-           culprit_remove(c);
+         c->ban_time = banned_time;
+         msg(L_INFO, "Banned %s: failures=%u ban_time=%u", AFMT(addr), c->fail_count, c->ban_time);
+         c->sentence_count = 1;
+         culprit_set_state(c, STATE_BANNED, c->ban_time);
+         is_modify(1, c->addr);

        }
       else
        }
       else

+       culprit_set_state(c, STATE_SUSPECT, suspect_time);
+      break;
+    case STATE_BANNED:
+      break;
+    case STATE_PROBATION:
+      c->fail_count += cnt;
+      if (c->fail_count > max_probation)

        {
        {

-         msg(L_DEBUG, "Suspect %s: acquitted", AFMT(c->addr));
-         culprit_remove(c);
+         c->sentence_count++;
+         c->ban_time = MIN((uns)(c->ban_time * banned_again_coeff), max_banned_time);
+         msg(L_INFO, "Re-banned %s: failures=%u sentences=%u ban_time=%u", AFMT(c->addr), c->fail_count, c->sentence_count, c->ban_time);
+         culprit_set_state(c, STATE_BANNED, c->ban_time);
+         is_modify(1, c->addr);

        }
        }

+      else
+       culprit_set_state(c, STATE_PROBATION, probation_time);
+      break;
+    default:
+      ASSERT(0);

     }
 }
 
     }
 }
 

-static void culprit_cleanup(void)
+static void culprit_timer(struct main_timer *tm)

 {
 {

-  timestamp_t next_cleanup = main_get_now() + (timestamp_t)3600 * 1000;
-  cleanup_list(&banned_list, &num_banned, (timestamp_t)max_banned_time * 1000, max_banned, &next_cleanup);
-  cleanup_list(&suspect_list, &num_suspects, (timestamp_t)max_suspect_time * 1000, max_suspects, &next_cleanup);
-  timer_add(&cleanup_timer, next_cleanup);
-}
-
-static void handle_failed_login(struct addr addr, int cnt)
-{
-  int is_new;
-  timestamp_t now = main_get_now();
+  struct culprit *c = tm->data;

 
 

-  struct culprit_node *c = culprit_lookup((byte *) &addr, &is_new);
-  if (is_new)
+  switch (c->state)

     {
     {

-      c->last_fail = now;
-      c->fail_count = cnt;
-      c->banned = 0;
-      clist_add_tail(&suspect_list, &c->n);
-      num_suspects++;
-      msg(L_DEBUG, "Suspect %s: new, failures=%u", AFMT(addr), c->fail_count);
+    case STATE_SUSPECT:
+    case STATE_PROBATION:
+      msg(L_DEBUG, "Suspect %s: acquitted", AFMT(c->addr));
+      culprit_delete(c);
+      break;
+    case STATE_BANNED:
+      msg(L_INFO, "Unbanned %s", AFMT(c->addr));
+      culprit_set_state(c, STATE_PROBATION, probation_time);
+      is_modify(0, c->addr);
+      break;
+    default:
+      ASSERT(0);

     }
     }

-  else if (!c->banned)
-    {
-      c->last_fail = now;
-      c->fail_count += cnt;
-      clist_remove(&c->n);
-      clist_add_tail(&suspect_list, &c->n);
-      msg(L_DEBUG, "Suspect %s: failures=%u", AFMT(addr), c->fail_count);
-    }
-
-  if (!c->banned && c->fail_count >= max_failures)
-    {
-      msg(L_INFO, "Banning %s: failures=%u", AFMT(addr), c->fail_count);
-      c->banned = 1;
-      clist_remove(&c->n);
-      num_suspects--;
-      clist_add_tail(&banned_list, &c->n);
-      num_banned++;
-      is_modify(1, c->addr);
-    }
-
-  culprit_cleanup();
-}
-
-static void culprit_timer(struct main_timer *tm UNUSED)
-{
-  culprit_cleanup();
-}
-
-static void fail_init(void)
-{
-  culprit_init();
-  clist_init(&suspect_list);
-  clist_init(&banned_list);
-  cleanup_timer.handler = culprit_timer;

 }
 
 /*** Parsing of log messages ***/
 }
 
 /*** Parsing of log messages ***/


@@ -554,7 +554,7 @@ int main(int argc UNUSED, char **argv)
 
   main_init();
   is_init();
 
   main_init();
   is_init();

-  fail_init();
+  culprit_hash_init();

   sk_init();
 
   is_flush(ipv4_set);
   sk_init();
 
   is_flush(ipv4_set);

diff --git a/config b/config
index 10c72b6a6696532d6bd217382bbbb2a9ca1063df..cb7d746279e9e65765b3dded755a659076082a6b 100644 (file)
--- a/config
+++ b/config
@@ -7,22 +7,29 @@ ListenOn      /var/run/bouncer.sock
 
 # On the first login failure, we remember that an IP address is suspect
 # and start counting failures. After too much failures, the address is banned.
 
 # On the first login failure, we remember that an IP address is suspect
 # and start counting failures. After too much failures, the address is banned.

-MaxFailures    10
+MaxFailures    9

 
 

-# When a suspect address generates no more failure for this many seconds,
-# it is forgotten.
-MaxSuspectTime 600
+# When a suspect address produces no further failures within this time [sec],
+# it is acquitted and forgotten.
+SuspectTime    600

 
 # Bans are lifted after this many seconds.
 
 # Bans are lifted after this many seconds.

-MaxBannedTime  3600
+BannedTime     3600

 
 

-# When a ban is lifted, the address is again considered suspect
-# and its number of failures is set to MaxFailures - Probation (0=disable).
-Probation      2
+# After a ban is lifted, the IP address undergoes further probation. If it
+# produces more failures within the probation period, it is banned again.
+MaxProbation   1
+
+# When an address is banned again during probation, its ban time is multiplied
+# by BannedAgainCoeff, but it cannot exceed MaxBannedTime [sec].
+BannedAgainCoeff       2
+MaxBannedtime          86400
+
+# Probation expires after [sec]
+ProbationTime  600

 
 # Limit on the number of suspect addresses and bans we keep in memory
 
 # Limit on the number of suspect addresses and bans we keep in memory

-MaxSuspects    1000
-MaxBanned      1000
+MaxCulprits    1000

 
 # We log all messages to the log stream configured below
 LogStream      syslog
 
 # We log all messages to the log stream configured below
 LogStream      syslog