[ViewVC] Diff of: cvs/gvpe/src/protocol.C

Comparing gvpe/src/protocol.C (file contents):
Revision 1.15 by pcg, Sun Mar 23 14:49:16 2003 UTC vs.
Revision 1.16 by pcg, Tue Mar 25 18:11:58 2003 UTC

 static const rsachallenge &
 challenge_bytes ()
 {
   static rsachallenge challenge;
-  static double challenge_ttl;	// time this challenge needs to be recreated
+  static tstamp challenge_ttl;	// time this challenge needs to be recreated
   if (NOW > challenge_ttl)
     {
       RAND_bytes ((unsigned char *)&challenge, sizeof (challenge));
       challenge_ttl = NOW + CHALLENGE_TTL;
 {
   for (i = QUEUEDEPTH; --i > 0; )
     delete queue[i];
 }
+struct net_rateinfo {
+  u32    host;
+  double pcnt, diff;
+  tstamp last;
+};
-// only do action once every x seconds per host.
+// only do action once every x seconds per host whole allowing bursts.
-// currently this is quite a slow implementation,
+// this implementation ("splay list" ;) is inefficient,
-// but suffices for normal operation.
+// but low on resources.
-struct u32_rate_limiter : private map<u32, tstamp>
+struct net_rate_limiter : private list<net_rateinfo>
- {
+{
-   tstamp every;
+  static const double ALPHA  = 1. - 1. / 90.; // allow bursts
+  static const double CUTOFF = 20.;           // one event every CUTOFF seconds
+  static const double EXPIRE = CUTOFF * 30.;  // expire entries after this time
-   bool can (u32 host);
+  bool can (u32 host);
-   u32_rate_limiter (tstamp every = 1)
-   {
-     this->every = every;
-   }
- };
-struct net_rate_limiter : u32_rate_limiter
-  {
-    bool can (SOCKADDR *sa) { return u32_rate_limiter::can((u32)sa->sin_addr.s_addr); }
+  bool can (SOCKADDR *sa) { return can((u32)sa->sin_addr.s_addr); }
-    bool can (sockinfo &si) { return u32_rate_limiter::can((u32)si.host); }
+  bool can (sockinfo &si) { return can((u32)si.host);             }
+};
-    net_rate_limiter (tstamp every) : u32_rate_limiter (every) {}
+net_rate_limiter auth_rate_limiter, reset_rate_limiter;
-  };
-bool u32_rate_limiter::can (u32 host)
+bool net_rate_limiter::can (u32 host)
 {
   iterator i;
   for (i = begin (); i != end (); )
-    if (i->second <= NOW)
+    if (i->host == host)
-      {
+      break;
+    else if (i->last < NOW - EXPIRE)
-        erase (i);
+      i = erase (i);
-        i = begin ();
-      }
     else
-      ++i;
+      i++;
-  i = find (host);
-  if (i != end ())
+  if (i == end ())
-    return false;
+    {
+      net_rateinfo ri;
-  insert (value_type (host, NOW + every));
+      ri.host = host;
+      ri.pcnt = 1.;
+      ri.diff = CUTOFF * (1. / (1. - ALPHA));
+      ri.last = NOW;
+      push_front (ri);
-  return true;
+      return true;
+    }
+  else
+    {
+      net_rateinfo ri (*i);
+      erase (i);
+      ri.pcnt = ri.pcnt * ALPHA;
+      ri.diff = ri.diff * ALPHA + (NOW - ri.last);
+      ri.last = NOW;
+      bool send = ri.diff / ri.pcnt > CUTOFF;
+      if (send)
+        ri.pcnt++;
+      //printf ("RATE %d %f,%f = %f > %f\n", !!send, ri.pcnt, ri.diff, ri.diff / ri.pcnt, CUTOFF);
+      push_front (ri);
+      return send;
+    }
 }
 /////////////////////////////////////////////////////////////////////////////
 static void next_wakeup (time_t next)
 }
 void
 connection::send_reset (SOCKADDR *dsa)
 {
-  static net_rate_limiter limiter(1);
-  if (limiter.can (dsa) && connectmode != conf_node::C_DISABLED)
+  if (reset_rate_limiter.can (dsa) && connectmode != conf_node::C_DISABLED)
     {
       config_packet *pkt = new config_packet;
       pkt->setup (vpn_packet::PT_RESET, conf->id);
       vpn->send_vpn_packet (pkt, dsa, IPTOS_MINCOST);
 }
 void
 connection::send_auth (auth_subtype subtype, SOCKADDR *sa, const rsachallenge *k)
 {
-  static net_rate_limiter limiter(0.2);
-  if (subtype != AUTH_INIT || limiter.can (sa))
+  if (subtype == AUTH_REPLY || auth_rate_limiter.can (sa))
     {
       if (!k)
         k = gen_challenge (seqrand, sa);
       auth_packet *pkt = new auth_packet (conf->id, subtype);
         {
           reset_dstaddr ();
           if (sa.sin_addr.s_addr)
             if (retry_cnt < 4)
               send_auth (AUTH_INIT, &sa);
-            else
+            else if (auth_rate_limiter.can (&sa))
               send_ping (&sa, 0);
         }
       else
         vpn->connect_request (conf->id);
     }
         conf->id, pkt->typ (), pkt->src (), pkt->dst ());
   switch (pkt->typ ())
     {
     case vpn_packet::PT_PING:
-      send_ping (ssa, 1); // pong
-      break;
-    case vpn_packet::PT_PONG:
       // we send pings instead of auth packets after some retries,
       // so reset the retry counter and establish a conenction
       // when we receive a pong.
       if (!ictx && !octx)
         {
           retry_cnt = 0;
           establish_connection.at = 0;
           establish_connection ();
         }
+      else
+        send_ping (ssa, 1); // pong
+      break;
+    case vpn_packet::PT_PONG:
       break;
     case vpn_packet::PT_RESET:
       {
         reset_connection ();
             if (!k)
               {
                 slog (L_ERR, _("challenge from %s (%s) illegal or corrupted"),
                       conf->nodename, (const char *)sockinfo (ssa));
+                send_reset (ssa);
                 break;
               }
             retry_cnt = 0;
             establish_connection.set (NOW + 8); //? ;)
     }
   ts = TSTAMP_CANCEL;
 }
+#include <sys/time.h>//D
 vpn::vpn (void)
 : udp_ev_watcher (this, &vpn::udp_ev)
 , vpn_ev_watcher (this, &vpn::vpn_ev)
 , event (this, &vpn::event_cb)
 {

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/protocol.C (file contents): Revision 1.15 by pcg, Sun Mar 23 14:49:16 2003 UTC vs. Revision 1.16 by pcg, Tue Mar 25 18:11:58 2003 UTC

Diff Legend

Comparing gvpe/src/protocol.C (file contents):
Revision 1.15 by pcg, Sun Mar 23 14:49:16 2003 UTC vs.
Revision 1.16 by pcg, Tue Mar 25 18:11:58 2003 UTC