diff --git a/doc/sample.config b/doc/sample.config index acea9a2a..d2c8c02e 100644 --- a/doc/sample.config +++ b/doc/sample.config @@ -211,11 +211,16 @@ auth-timeout = 40 # The time (in seconds) that a client is not allowed to reconnect after # a failed authentication attempt. -min-reauth-time = 120 +min-reauth-time = 300 -# The maximum number of password retries before applying the min-reauth-time -# delay. Set to zero to disable. -max-password-retries = 5 +# Banning clients in ocserv works with a point system. IP addresses +# that get a score over that configured number are banned for +# min-reauth-time seconds. A wrong password attempt is 5 points. +# Set to zero to disable. +max-ban-score = 30 + +# The time (in seconds) that all score kept for a client is reset. +ban-reset-time = 300 # Cookie timeout (in seconds) # Once a client is authenticated he's provided a cookie with diff --git a/src/Makefile.am b/src/Makefile.am index 30d14b0b..253f860c 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -74,7 +74,7 @@ ocserv_SOURCES = main.c main-auth.c worker-vpn.c worker-auth.c tlslib.c \ config.c worker-resume.c worker.h main-resume.c main.h \ worker-extras.c html.c html.h worker-http.c \ main-user.c worker-misc.c route-add.c route-add.h worker-privs.c \ - sec-mod.c sec-mod-db.c sec-mod-auth.c sec-mod-auth.h sec-mod.h sec-mod-ban.c \ + sec-mod.c sec-mod-db.c sec-mod-auth.c sec-mod-auth.h sec-mod.h \ script-list.h $(COMMON_SOURCES) $(AUTH_SOURCES) $(ACCT_SOURCES) \ icmp-ping.c icmp-ping.h worker-kkdcp.c subconfig.c \ sec-mod-sup-config.c sec-mod-sup-config.h \ @@ -83,6 +83,7 @@ ocserv_SOURCES = main.c main-auth.c worker-vpn.c worker-auth.c tlslib.c \ worker-bandwidth.c worker-bandwidth.h ctl.h main-ctl.h \ vasprintf.c vasprintf.h lzs.c lzs.h cfg.h \ proc-search.c proc-search.h http-heads.h \ + main-ban.c main-ban.h \ str.c str.h gettime.h $(CCAN_SOURCES) $(HTTP_PARSER_SOURCES) \ $(PROTOBUF_SOURCES) kkdcp.asn kkdcp_asn1_tab.c sec-mod-acct.h diff --git a/src/config.c b/src/config.c index 7382a3ba..d0b0f80d 100644 --- a/src/config.c +++ b/src/config.c @@ -80,7 +80,7 @@ static struct cfg_options available_options[] = { { .name = "compression", .type = OPTION_BOOLEAN, .mandatory = 0 }, { .name = "no-compress-limit", .type = OPTION_NUMERIC, .mandatory = 0 }, { .name = "tcp-port", .type = OPTION_NUMERIC, .mandatory = 0 }, - { .name = "max-password-retries", .type = OPTION_NUMERIC, .mandatory = 0 }, + { .name = "max-ban-score", .type = OPTION_NUMERIC, .mandatory = 0 }, { .name = "udp-port", .type = OPTION_NUMERIC, .mandatory = 0 }, { .name = "keepalive", .type = OPTION_NUMERIC, .mandatory = 0 }, { .name = "dpd", .type = OPTION_NUMERIC, .mandatory = 0 }, @@ -137,6 +137,7 @@ static struct cfg_options available_options[] = { { .name = "mobile-idle-timeout", .type = OPTION_NUMERIC, .mandatory = 0 }, { .name = "max-clients", .type = OPTION_NUMERIC, .mandatory = 0 }, { .name = "min-reauth-time", .type = OPTION_NUMERIC, .mandatory = 0 }, + { .name = "ban-reset-time", .type = OPTION_NUMERIC, .mandatory = 0 }, { .name = "max-same-clients", .type = OPTION_NUMERIC, .mandatory = 0 }, { .name = "rx-data-per-sec", .type = OPTION_NUMERIC, .mandatory = 0 }, @@ -818,11 +819,15 @@ unsigned urlfw_size = 0; READ_NUMERIC("max-clients", config->max_clients); READ_NUMERIC("min-reauth-time", config->min_reauth_time); + config->ban_reset_time = -1; + READ_NUMERIC("ban-reset-time", config->ban_reset_time); + if (config->ban_reset_time == -1) + config->ban_reset_time = DEFAULT_BAN_RESET_TIME; - config->max_password_retries = -1; - READ_NUMERIC("max-password-retries", config->max_password_retries); - if (config->max_password_retries == -1) - config->max_password_retries = MAX_PASSWORD_TRIES; + config->max_ban_score = -1; + READ_NUMERIC("max-ban-score", config->max_ban_score); + if (config->max_ban_score == -1) + config->max_ban_score = DEFAULT_MAX_BAN_SCORE; READ_NUMERIC("max-same-clients", config->max_same_clients); diff --git a/src/ipc.proto b/src/ipc.proto index 0c9bb489..f6f16fee 100644 --- a/src/ipc.proto +++ b/src/ipc.proto @@ -255,3 +255,10 @@ message sec_auth_session_reply_msg optional string explicit_ipv6 = 27; repeated string no_routes = 28; } + +/* SEC_BAN_IP: sent from sec-mod to main */ +message sec_auth_ban_ip +{ + required string ip = 1; + required uint32 score = 2; +} diff --git a/src/sec-mod-ban.c b/src/main-ban.c similarity index 63% rename from src/sec-mod-ban.c rename to src/main-ban.c index 58a81cc5..1b62fb49 100644 --- a/src/sec-mod-ban.c +++ b/src/main-ban.c @@ -38,14 +38,16 @@ #include #include #include -#include +#include +#include #include #include typedef struct ban_entry_st { char ip[MAX_IP_STR]; - unsigned failed_attempts; + unsigned score; + time_t last_reset; /* the time its score counting started */ time_t expires; /* the time after the client is allowed to login */ } ban_entry_st; @@ -70,21 +72,23 @@ static bool ban_entry_cmp(const void *_c1, void *_c2) } -void *sec_mod_ban_db_init(sec_mod_st *sec) +void *main_ban_db_init(main_server_st *s) { - struct htable *db = talloc(sec, struct htable); - if (db == NULL) - return NULL; + struct htable *db = talloc(s, struct htable); + if (db == NULL) { + fprintf(stderr, "error initializing ban DB\n"); + exit(1); + } htable_init(db, rehash, NULL); - sec->ban_db = db; + s->ban_db = db; return db; } -void sec_mod_ban_db_deinit(sec_mod_st *sec) +void main_ban_db_deinit(main_server_st *s) { -struct htable *db = sec->ban_db; +struct htable *db = s->ban_db; if (db != NULL) { htable_clear(db); @@ -92,9 +96,9 @@ struct htable *db = sec->ban_db; } } -unsigned sec_mod_ban_db_elems(sec_mod_st *sec) +unsigned main_ban_db_elems(main_server_st *s) { -struct htable *db = sec->ban_db; +struct htable *db = s->ban_db; if (db) return db->elems; @@ -102,12 +106,13 @@ struct htable *db = sec->ban_db; return 0; } -void add_ip_to_ban_list(sec_mod_st *sec, const char *ip, unsigned attempts, time_t reset_time) +void add_ip_to_ban_list(main_server_st *s, const char *ip, unsigned score) { - struct htable *db = sec->ban_db; + struct htable *db = s->ban_db; struct ban_entry_st *e; ban_entry_st t; time_t now = time(0); + time_t reset_time = now + s->config->min_reauth_time; if (db == NULL || ip == NULL || ip[0] == 0) return; @@ -124,24 +129,26 @@ void add_ip_to_ban_list(sec_mod_st *sec, const char *ip, unsigned attempts, time } strlcpy(e->ip, ip, sizeof(e->ip)); + e->last_reset = now; if (htable_add(db, rehash(e, NULL), e) == 0) { - seclog(sec, LOG_INFO, + mslog(s, NULL, LOG_INFO, "could not add ban entry to hash table"); goto fail; } } else { - if (now > e->expires) { - e->failed_attempts = 0; + if (now > e->last_reset + s->config->ban_reset_time) { + e->score = 0; + e->last_reset = now; } } - e->failed_attempts += attempts; + e->score += score; e->expires = reset_time; - if (sec->config->max_password_retries > 0 && e->failed_attempts >= sec->config->max_password_retries) { - seclog(sec, LOG_INFO,"added IP '%s' (with failed attempts %d) to ban list, will be reset at: %s", ip, e->failed_attempts, ctime(&reset_time)); + if (s->config->max_ban_score > 0 && e->score >= s->config->max_ban_score) { + mslog(s, NULL, LOG_INFO,"added IP '%s' (with score %d) to ban list, will be reset at: %s", ip, e->score, ctime(&reset_time)); } else { - seclog(sec, LOG_DEBUG,"added failed attempt for IP '%s' to ban list, will be reset at: %s", ip, ctime(&reset_time)); + mslog(s, NULL, LOG_DEBUG,"added failed attempt for IP '%s' to ban list", ip); } return; @@ -150,9 +157,9 @@ void add_ip_to_ban_list(sec_mod_st *sec, const char *ip, unsigned attempts, time return; } -void remove_ip_from_ban_list(sec_mod_st *sec, const char *ip) +void remove_ip_from_ban_list(main_server_st *s, const char *ip) { - struct htable *db = sec->ban_db; + struct htable *db = s->ban_db; struct ban_entry_st *e; ban_entry_st t; @@ -165,41 +172,42 @@ void remove_ip_from_ban_list(sec_mod_st *sec, const char *ip) e = htable_get(db, rehash(&t, NULL), ban_entry_cmp, &t); if (e != NULL) { /* new entry */ - e->failed_attempts = 0; + e->score = 0; e->expires = 0; } return; } -unsigned check_if_banned(sec_mod_st *sec, const char *ip) +unsigned check_if_banned(main_server_st *s, struct sockaddr_storage *addr, socklen_t addr_size) { - struct htable *db = sec->ban_db; + struct htable *db = s->ban_db; time_t now; ban_entry_st t, *e; - if (db == NULL || ip == NULL || ip[0] == 0) + if (db == NULL) return 0; - /* pass the current time somehow */ - now = time(0); - strlcpy(t.ip, ip, sizeof(t.ip)); + if (human_addr2((struct sockaddr*)addr, addr_size, t.ip, sizeof(t.ip), 0) != NULL) { + /* pass the current time somehow */ + now = time(0); + e = htable_get(db, rehash(&t, NULL), ban_entry_cmp, &t); + if (e != NULL) { + if (now > e->expires) + return 0; - e = htable_get(db, rehash(&t, NULL), ban_entry_cmp, &t); - if (e != NULL) { - if (now > e->expires) - return 0; - - if (sec->config->max_password_retries > 0 && - e->failed_attempts >= sec->config->max_password_retries) - return 1; + if (s->config->max_ban_score > 0 && + e->score >= s->config->max_ban_score) { + return 1; + } + } } return 0; } -void cleanup_banned_entries(sec_mod_st *sec) +void cleanup_banned_entries(main_server_st *s) { - struct htable *db = sec->ban_db; + struct htable *db = s->ban_db; ban_entry_st *t; struct htable_iter iter; time_t now = time(0); @@ -209,7 +217,7 @@ void cleanup_banned_entries(sec_mod_st *sec) t = htable_first(db, &iter); while (t != NULL) { - if (now >= t->expires) { + if (now >= t->expires && now > t->last_reset + s->config->ban_reset_time) { htable_delval(db, &iter); talloc_free(t); } diff --git a/src/main-ban.h b/src/main-ban.h new file mode 100644 index 00000000..e20e82b2 --- /dev/null +++ b/src/main-ban.h @@ -0,0 +1,34 @@ +/* + * Copyright (C) 2015 Nikos Mavrogiannopoulos + * + * Author: Nikos Mavrogiannopoulos + * + * This file is part of ocserv. + * + * The GnuTLS is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public License + * as published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this program. If not, see + */ +#ifndef MAIN_BAN_H +# define MAIN_BAN_H + +# include "main.h" + +void cleanup_banned_entries(main_server_st *s); +unsigned check_if_banned(main_server_st *s, struct sockaddr_storage *addr, socklen_t addr_size); +void add_ip_to_ban_list(main_server_st *s, const char *ip, unsigned score); +void remove_ip_from_ban_list(main_server_st *s, const char *ip); +unsigned main_ban_db_elems(main_server_st *s); +void main_ban_db_deinit(main_server_st *s); +void *main_ban_db_init(main_server_st *s); + +#endif diff --git a/src/main-sec-mod-cmd.c b/src/main-sec-mod-cmd.c index c9b65a85..29cfa48e 100644 --- a/src/main-sec-mod-cmd.c +++ b/src/main-sec-mod-cmd.c @@ -35,8 +35,6 @@ #include #include #include -#include -#include #include "common.h" #include "str.h" #include "setproctitle.h" @@ -47,6 +45,7 @@ #include #include +#include #include int handle_sec_mod_commands(main_server_st * s) @@ -58,7 +57,7 @@ int handle_sec_mod_commands(main_server_st * s) uint8_t *raw; int ret, raw_len, e; void *pool = talloc_new(s); - //PROTOBUF_ALLOCATOR(pa, pool); + PROTOBUF_ALLOCATOR(pa, pool); if (pool == NULL) return -1; @@ -112,6 +111,21 @@ int handle_sec_mod_commands(main_server_st * s) } switch (cmd) { + case SM_CMD_AUTH_BAN_IP:{ + SecAuthBanIp *tmsg; + + tmsg = sec_auth_ban_ip__unpack(&pa, raw_len, raw); + if (tmsg == NULL) { + mslog(s, NULL, LOG_ERR, "error unpacking sec-mod data"); + ret = ERR_BAD_COMMAND; + goto cleanup; + } + add_ip_to_ban_list(s, tmsg->ip, tmsg->score); + + sec_auth_ban_ip__free_unpacked(tmsg, &pa); + } + + break; default: mslog(s, NULL, LOG_ERR, "unknown CMD from sec-mod 0x%x.", (unsigned)cmd); ret = ERR_BAD_COMMAND; diff --git a/src/main.c b/src/main.c index 96922a2a..17f1ac39 100644 --- a/src/main.c +++ b/src/main.c @@ -52,6 +52,7 @@ #endif #include #include +#include #include #include #include @@ -633,6 +634,7 @@ void clear_lists(main_server_st *s) ip_lease_deinit(&s->ip_leases); proc_table_deinit(s); ctl_handler_deinit(s); + main_ban_db_deinit(s); } static void kill_children(main_server_st* s) @@ -863,11 +865,12 @@ unsigned total = 10; exit(0); } - /* Check if we need to expire any cookies */ + /* Check if we need to expire any data */ if (need_maintenance != 0) { need_maintenance = 0; - mslog(s, NULL, LOG_DEBUG, "performing maintenance"); + mslog(s, NULL, LOG_DEBUG, "performing maintenance (banned IPs: %d)", main_ban_db_elems(s)); expire_tls_sessions(s); + cleanup_banned_entries(s); alarm(MAINTAINANCE_TIME(s)); } } @@ -943,6 +946,7 @@ int main(int argc, char** argv) tls_cache_init(s, &s->tls_db); ip_lease_init(&s->ip_leases); proc_table_init(s); + main_ban_db_init(s); sigemptyset(&blockset); sigemptyset(&emptyset); @@ -1156,6 +1160,12 @@ int main(int argc, char** argv) break; } + if (check_if_banned(s, &ws->remote_addr, ws->remote_addr_len) != 0) { + close(fd); + mslog(s, NULL, LOG_INFO, "Rejected connection from banned IP"); + break; + } + /* Create a command socket */ ret = socketpair(AF_UNIX, SOCK_STREAM, 0, cmd_fd); if (ret < 0) { diff --git a/src/main.h b/src/main.h index 37d8d08c..ca9ce06e 100644 --- a/src/main.h +++ b/src/main.h @@ -181,6 +181,8 @@ typedef struct main_server_st { struct cookie_entry_db_st cookies; tls_sess_db_st tls_db; + struct htable *ban_db; + tls_st *creds; uint8_t cookie_key[COOKIE_KEY_SIZE]; diff --git a/src/ocserv-args.def b/src/ocserv-args.def index d28d80cc..470a11fa 100644 --- a/src/ocserv-args.def +++ b/src/ocserv-args.def @@ -288,9 +288,14 @@ auth-timeout = 40 # a failed authentication attempt. min-reauth-time = 120 -# The maximum number of password retries before applying the min-reauth-time -# delay. Set to zero to disable. -max-password-retries = 5 +# Banning clients in ocserv works with a point system. IP addresses +# that get a score over that configured number are banned for +# min-reauth-time seconds. A wrong password attempt is 5 points. +# Set to zero to disable. +max-ban-score = 30 + +# The time (in seconds) that all score kept for a client is reset. +ban-reset-time = 300 # Cookie timeout (in seconds) # Once a client is authenticated he's provided a cookie with diff --git a/src/sec-mod-auth.c b/src/sec-mod-auth.c index 64f2f89e..078071ba 100644 --- a/src/sec-mod-auth.c +++ b/src/sec-mod-auth.c @@ -72,6 +72,33 @@ void sec_auth_init(sec_mod_st * sec, struct cfg_st *config) config->acct.amod->global_init(sec, config->server_name, config->acct.additional); } +static +void sec_mod_add_score_to_ip(sec_mod_st *sec, void *pool, const char *ip, unsigned points) +{ + void *lpool; + int ret, e; + SecAuthBanIp msg = SEC_AUTH_BAN_IP__INIT; + + msg.ip = (char*)ip; + msg.score = points; + + lpool = talloc_new(pool); + if (lpool == NULL) { + return; + } + + ret = send_msg(lpool, sec->cmd_fd, SM_CMD_AUTH_BAN_IP, &msg, + (pack_size_func) sec_auth_ban_ip__get_packed_size, + (pack_func) sec_auth_ban_ip__pack); + if (ret < 0) { + e = errno; + seclog(sec, LOG_WARNING, "error in sending BAN IP message: %s", strerror(e)); + } + talloc_free(lpool); + + return; +} + static int generate_cookie(sec_mod_st * sec, client_entry_st * entry) { int ret; @@ -272,7 +299,7 @@ int handle_sec_auth_res(int cfd, sec_mod_st * sec, client_entry_st * e, int resu if (result == ERR_AUTH_CONTINUE) { /* if the module allows multiple retries for the password */ if (e->status != PS_AUTH_INIT && e->module && e->module->allows_retries) { - add_ip_to_ban_list(sec, e->auth_info.remote_ip, 1, time(0) + sec->config->min_reauth_time); + sec_mod_add_score_to_ip(sec, e, e->auth_info.remote_ip, PASSWORD_POINTS); } ret = send_sec_auth_reply_msg(cfd, sec, e); @@ -296,13 +323,12 @@ int handle_sec_auth_res(int cfd, sec_mod_st * sec, client_entry_st * e, int resu seclog(sec, LOG_ERR, "could not send reply auth cmd."); return ret; } - remove_ip_from_ban_list(sec, e->auth_info.remote_ip); ret = 0; } else { e->status = PS_AUTH_FAILED; - add_ip_to_ban_list(sec, e->auth_info.remote_ip, 1, time(0) + sec->config->min_reauth_time); + sec_mod_add_score_to_ip(sec, e, e->auth_info.remote_ip, PASSWORD_POINTS); ret = send_sec_auth_reply(cfd, sec, e, AUTH__REP__FAILED); if (ret < 0) { @@ -484,12 +510,6 @@ int handle_sec_auth_cont(int cfd, sec_mod_st * sec, const SecAuthContMsg * req) client_entry_st *e; int ret; - if (check_if_banned(sec, req->ip) != 0) { - seclog(sec, LOG_INFO, - "IP '%s' is banned", req->ip); - return -1; - } - if (req->sid.len != SID_SIZE) { seclog(sec, LOG_ERR, "auth cont but with illegal sid size (%d)!", (int)req->sid.len); @@ -569,12 +589,6 @@ int handle_sec_auth_init(int cfd, sec_mod_st * sec, const SecAuthInitMsg * req) client_entry_st *e; unsigned need_continue = 0; - if (check_if_banned(sec, req->ip) != 0) { - seclog(sec, LOG_INFO, - "IP '%s' is banned", req->ip); - return -1; - } - e = new_client_entry(sec, req->ip); if (e == NULL) { seclog(sec, LOG_ERR, "cannot initialize memory"); diff --git a/src/sec-mod.c b/src/sec-mod.c index 26c8d432..084adbf7 100644 --- a/src/sec-mod.c +++ b/src/sec-mod.c @@ -368,7 +368,6 @@ static void check_other_work(sec_mod_st *sec) } sec_mod_client_db_deinit(sec); - sec_mod_ban_db_deinit(sec); talloc_free(sec); exit(0); } @@ -382,10 +381,8 @@ static void check_other_work(sec_mod_st *sec) if (need_maintainance) { seclog(sec, LOG_DEBUG, "performing maintenance"); cleanup_client_entries(sec); - cleanup_banned_entries(sec); - seclog(sec, LOG_DEBUG, "active sessions %d, banned entries %d", - sec_mod_client_db_elems(sec), - sec_mod_ban_db_elems(sec)); + seclog(sec, LOG_DEBUG, "active sessions %d", + sec_mod_client_db_elems(sec)); alarm(MAINTAINANCE_TIME); need_maintainance = 0; } @@ -492,7 +489,6 @@ void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_f #ifdef DEBUG_LEAKS talloc_enable_leak_report_full(); #endif - sigemptyset(&blockset); sigemptyset(&emptyset); sigaddset(&blockset, SIGALRM); @@ -538,6 +534,7 @@ void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_f alarm(MAINTAINANCE_TIME); sec_auth_init(sec, config); + sec->cmd_fd = cmd_fd; #ifdef HAVE_PKCS11 ret = gnutls_pkcs11_reinit(); @@ -552,10 +549,6 @@ void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_f exit(1); } - if (config->min_reauth_time > 0) - sec_mod_ban_db_init(sec); - - sd = socket(AF_UNIX, SOCK_STREAM, 0); if (sd == -1) { e = errno; diff --git a/src/sec-mod.h b/src/sec-mod.h index 829aca11..9c7c2444 100644 --- a/src/sec-mod.h +++ b/src/sec-mod.h @@ -34,7 +34,7 @@ typedef struct sec_mod_st { gnutls_privkey_t *key; unsigned key_size; struct htable *client_db; - struct htable *ban_db; + int cmd_fd; struct config_mod_st *config_module; } sec_mod_st; @@ -127,12 +127,4 @@ void sec_auth_user_deinit(sec_mod_st * sec, client_entry_st * e); void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_file, uint8_t cookie_key[COOKIE_KEY_SIZE], int cmd_fd); -void cleanup_banned_entries(sec_mod_st *sec); -unsigned check_if_banned(sec_mod_st *sec, const char *ip); -void add_ip_to_ban_list(sec_mod_st *sec, const char *ip, unsigned attempts, time_t reset_time); -void remove_ip_from_ban_list(sec_mod_st *sec, const char *ip); -void *sec_mod_ban_db_init(sec_mod_st *sec); -void sec_mod_ban_db_deinit(sec_mod_st *sec); -unsigned sec_mod_ban_db_elems(sec_mod_st *sec); - #endif diff --git a/src/vpn.h b/src/vpn.h index 6959ac4c..9d03d25c 100644 --- a/src/vpn.h +++ b/src/vpn.h @@ -32,6 +32,7 @@ #include #include #include +#include #ifdef __GNUC__ # define _OCSERV_GCC_VERSION (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__) @@ -56,6 +57,14 @@ typedef enum { OC_COMP_LZS, } comp_type_t; +/* Banning works with a point system. A wrong password + * attempt gives you PASSWORD_POINTS, and you are banned + * when the maximum ban score is reached. + */ +#define PASSWORD_POINTS 5 +#define DEFAULT_MAX_BAN_SCORE (MAX_PASSWORD_TRIES*PASSWORD_POINTS) +#define DEFAULT_BAN_RESET_TIME 300 + #define MIN_NO_COMPRESS_LIMIT 64 #define DEFAULT_NO_COMPRESS_LIMIT 256 @@ -134,15 +143,19 @@ typedef enum { CMD_SESSION_INFO = 13, CMD_CLI_STATS = 15, + /* from worker to sec-mod */ SM_CMD_AUTH_INIT = 120, SM_CMD_AUTH_CONT, SM_CMD_AUTH_REP, SM_CMD_DECRYPT, SM_CMD_SIGN, + SM_CMD_CLI_STATS, + + /* from main to sec-mod and vice versa */ SM_CMD_AUTH_SESSION_OPEN, SM_CMD_AUTH_SESSION_CLOSE, SM_CMD_AUTH_SESSION_REPLY, - SM_CMD_CLI_STATS, + SM_CMD_AUTH_BAN_IP, } cmd_request_t; #define MAX_IP_STR 46 @@ -307,7 +320,8 @@ struct cfg_st { unsigned rekey_method; /* REKEY_METHOD_ */ time_t min_reauth_time; /* after a failed auth, how soon one can reauthenticate -> in seconds */ - int max_password_retries; /* the number of retries allowed prior to applying min_reauth_time */ + int max_ban_score; /* the score allowed before a user is banned (see vpn.h) */ + int ban_reset_time; unsigned isolate; /* whether seccomp should be enabled or not */