mirror of
https://git.FreeBSD.org/src.git
synced 2024-11-29 08:08:37 +00:00
/Really/ deprecate ConnectionsPerPeriod, ripping out the code for it
and giving a dire error to its lingering users.
This commit is contained in:
Brian Feldman
parent
69c0804d32
commit
ea0187039a
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=70990
@ -680,18 +680,7 @@ read_server_config(ServerOptions *options, const char *filename)
|
||||
break;
|
||||
|
||||
case sConnectionsPerPeriod:
|
||||
arg = strdelim(&cp);
|
||||
if (cp == NULL)
|
||||
fatal("%.200s line %d: missing (>= 0) number argument.\n",
|
||||
filename, linenum);
|
||||
if (sscanf(arg, "%u/%u", &options->connections_per_period,
|
||||
&options->connections_period) != 2)
|
||||
fatal("%.200s line %d: invalid numerical argument(s).\n",
|
||||
filename, linenum);
|
||||
if (options->connections_per_period != 0 &&
|
||||
options->connections_period == 0)
|
||||
fatal("%.200s line %d: invalid connections period.\n",
|
||||
filename, linenum);
|
||||
fatal("ConnectionsPerPeriod has been deprecated.");
|
||||
break;
|
||||
|
||||
case sSubsystem:
|
||||
|
||||
@ -337,31 +337,6 @@ Specifies whether
|
||||
should check for new mail for interactive logins.
|
||||
The default is
|
||||
.Dq yes .
|
||||
.It Cm ConnectionsPerPeriod
|
||||
This keyword allows for rate-limiting of connections, and
|
||||
is followed by two numbers in the format
|
||||
.Dq n/s ,
|
||||
where
|
||||
.Ar n
|
||||
is the number of connections from a certain address group
|
||||
accepted per period of
|
||||
.Ar s
|
||||
seconds. Any connection after the number
|
||||
.Ar n
|
||||
connection in the period of
|
||||
.Ar s
|
||||
seconds will be dropped, and an informational message will be logged.
|
||||
A connection will belong to a certain group, of which there are 13
|
||||
by default, according to its IP address.
|
||||
The default for this keyword is
|
||||
.Dq 0/0 ,
|
||||
and rate-limiting can be explicitly turned off by using an
|
||||
.Ar n
|
||||
parameter of
|
||||
.Ql 0
|
||||
and any
|
||||
.Ar s
|
||||
parameter.
|
||||
.It Cm DenyGroups
|
||||
This keyword can be followed by a number of group names, separated
|
||||
by spaces.
|
||||
|
||||
@ -167,32 +167,6 @@ unsigned char session_id[16];
|
||||
unsigned char *session_id2 = NULL;
|
||||
int session_id2_len = 0;
|
||||
|
||||
/* These are used to implement connections_per_period. */
|
||||
struct ratelim_connection {
|
||||
struct timeval connections_begin;
|
||||
unsigned int connections_this_period;
|
||||
} *ratelim_connections;
|
||||
|
||||
static void
|
||||
ratelim_init(void) {
|
||||
ratelim_connections = calloc(num_listen_socks,
|
||||
sizeof(struct ratelim_connection));
|
||||
if (ratelim_connections == NULL)
|
||||
fatal("calloc: %s", strerror(errno));
|
||||
}
|
||||
|
||||
static __inline struct timeval
|
||||
timevaldiff(struct timeval *tv1, struct timeval *tv2) {
|
||||
struct timeval diff;
|
||||
int carry;
|
||||
|
||||
carry = tv1->tv_usec > tv2->tv_usec;
|
||||
diff.tv_sec = tv2->tv_sec - tv1->tv_sec - (carry ? 1 : 0);
|
||||
diff.tv_usec = tv2->tv_usec - tv1->tv_usec + (carry ? 1000000 : 0);
|
||||
|
||||
return diff;
|
||||
}
|
||||
|
||||
/* record remote hostname or ip */
|
||||
unsigned int utmp_len = MAXHOSTNAMELEN;
|
||||
|
||||
@ -508,7 +482,6 @@ main(int ac, char **av)
|
||||
int opt, sock_in = 0, sock_out = 0, newsock, j, i, fdsetsz, on = 1;
|
||||
pid_t pid;
|
||||
socklen_t fromlen;
|
||||
int ratelim_exceeded = 0;
|
||||
int silent = 0;
|
||||
fd_set *fdset;
|
||||
struct sockaddr_storage from;
|
||||
@ -874,8 +847,6 @@ main(int ac, char **av)
|
||||
for (i = 0; i < options.max_startups; i++)
|
||||
startup_pipes[i] = -1;
|
||||
|
||||
ratelim_init();
|
||||
|
||||
/*
|
||||
* Stay listening for connections until the system crashes or
|
||||
* the daemon is killed with a signal.
|
||||
@ -948,27 +919,6 @@ main(int ac, char **av)
|
||||
break;
|
||||
}
|
||||
|
||||
if (options.connections_per_period != 0) {
|
||||
struct timeval diff, connections_end;
|
||||
struct ratelim_connection *rc;
|
||||
|
||||
(void)gettimeofday(&connections_end, NULL);
|
||||
rc = &ratelim_connections[i];
|
||||
diff = timevaldiff(&rc->connections_begin,
|
||||
&connections_end);
|
||||
if (diff.tv_sec >= options.connections_period) {
|
||||
/*
|
||||
* Slide the window forward only after
|
||||
* completely leaving it.
|
||||
*/
|
||||
rc->connections_begin = connections_end;
|
||||
rc->connections_this_period = 1;
|
||||
} else {
|
||||
if (++rc->connections_this_period >
|
||||
options.connections_per_period)
|
||||
ratelim_exceeded = 1;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Got connection. Fork a child to handle it, unless
|
||||
@ -987,19 +937,6 @@ main(int ac, char **av)
|
||||
startup_pipe = -1;
|
||||
pid = getpid();
|
||||
break;
|
||||
} else if (ratelim_exceeded) {
|
||||
const char *myaddr;
|
||||
|
||||
myaddr = get_ipaddr(newsock);
|
||||
log("rate limit (%u/%u) on %s port %d "
|
||||
"exceeded by %s",
|
||||
options.connections_per_period,
|
||||
options.connections_period, myaddr,
|
||||
get_sock_port(newsock, 1), ntop);
|
||||
free((void *)myaddr);
|
||||
close(newsock);
|
||||
ratelim_exceeded = 0;
|
||||
continue;
|
||||
} else {
|
||||
/*
|
||||
* Normal production daemon. Fork, and have
|
||||
|
||||
@ -12,8 +12,7 @@ ServerKeyBits 768
|
||||
LoginGraceTime 120
|
||||
KeyRegenerationInterval 3600
|
||||
PermitRootLogin no
|
||||
# Deprecated: rate-limit sshd connections to 5 connections per 10 seconds
|
||||
# ConnectionsPerPeriod 5/10
|
||||
# ConnectionsPerPeriod has been deprecated completely
|
||||
|
||||
# After 10 unauthenticated connections, refuse 30% of the new ones, and
|
||||
# refuse any more than 60 total.
|
||||
|
||||
Loading…
Reference in New Issue
Block a user