9pfs/solanum-vs-hackint-and-charybdis
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

m_sasl: temporarily reject clients after many failed attempts

Browse source
This commit is contained in:
Mantas Mikulėnas 2015-02-13 20:13:06 +02:00
parent c9b6f58349
commit 37289346cd
No known key found for this signature in database
GPG key ID: D24F6CB2C1B52632
2 changed files with 16 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
include/client.h
View file

@ -285,6 +285,7 @@ struct LocalUser
char sasl_agent[IDLEN]; char sasl_agent[IDLEN];
unsigned char sasl_out; unsigned char sasl_out;
unsigned char sasl_complete; unsigned char sasl_complete;
unsigned short sasl_messages;
}; };
struct AuthClient struct AuthClient

16
modules/m_sasl.c
View file

@ -35,6 +35,7 @@
#include "msg.h" #include "msg.h"
#include "modules.h" #include "modules.h"
#include "numeric.h" #include "numeric.h"
#include "reject.h"
#include "s_serv.h" #include "s_serv.h"
#include "s_stats.h" #include "s_stats.h"
#include "string.h" #include "string.h"
@ -223,17 +224,30 @@ me_sasl(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *source_
rb_strlcpy(target_p->localClient->sasl_agent, parv[1], IDLEN); rb_strlcpy(target_p->localClient->sasl_agent, parv[1], IDLEN);
if(*parv[3] == 'C') if(*parv[3] == 'C')
{
sendto_one(target_p, "AUTHENTICATE %s", parv[4]); sendto_one(target_p, "AUTHENTICATE %s", parv[4]);
target_p->localClient->sasl_messages++;
}
else if(*parv[3] == 'D') else if(*parv[3] == 'D')
{ {
if(*parv[4] == 'F') if(*parv[4] == 'F') {
sendto_one(target_p, form_str(ERR_SASLFAIL), me.name, EmptyString(target_p->name) ? "*" : target_p->name); sendto_one(target_p, form_str(ERR_SASLFAIL), me.name, EmptyString(target_p->name) ? "*" : target_p->name);
if (target_p->localClient->sasl_messages > 0)
{
if (throttle_add((struct sockaddr*)&target_p->localClient->ip))
{
exit_client(target_p, target_p, &me, "Too many failed authentication attempts");
return;
}
}
}
else if(*parv[4] == 'S') { else if(*parv[4] == 'S') {
sendto_one(target_p, form_str(RPL_SASLSUCCESS), me.name, EmptyString(target_p->name) ? "*" : target_p->name); sendto_one(target_p, form_str(RPL_SASLSUCCESS), me.name, EmptyString(target_p->name) ? "*" : target_p->name);
target_p->localClient->sasl_complete = 1; target_p->localClient->sasl_complete = 1;
ServerStats.is_ssuc++; ServerStats.is_ssuc++;
} }
*target_p->localClient->sasl_agent = '\0'; /* Blank the stored agent so someone else can answer */ *target_p->localClient->sasl_agent = '\0'; /* Blank the stored agent so someone else can answer */
target_p->localClient->sasl_messages = 0;
} }
else if(*parv[3] == 'M') else if(*parv[3] == 'M')
sendto_one(target_p, form_str(RPL_SASLMECHS), me.name, EmptyString(target_p->name) ? "*" : target_p->name, parv[4]); sendto_one(target_p, form_str(RPL_SASLMECHS), me.name, EmptyString(target_p->name) ? "*" : target_p->name, parv[4]);