X-Git-Url: https://www.tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Fnet_socket.c;h=6828da7a8ce23b9213f9f00fd43f388400aa7448;hb=c1703ea9172be05f501d636510834e31d5d4f98c;hp=ded9224d48dd720bfd11ccb7e9c6f334da0d8060;hpb=24e3ec863ec463186501f76961c6d4b1dfe122af;p=tinc

diff --git a/src/net_socket.c b/src/net_socket.c
index ded9224d..6828da7a 100644
--- a/src/net_socket.c
+++ b/src/net_socket.c
@@ -113,6 +113,34 @@ static bool bind_to_interface(int sd) {
 	return true;
 }
 
+static bool bind_to_address(connection_t *c) {
+	int s = -1;
+
+	for(int i = 0; i < listen_sockets; i++) {
+		if(listen_socket[i].sa.sa.sa_family != c->address.sa.sa_family)
+			continue;
+		if(s >= 0)
+			return false;
+		s = i;
+	}
+
+	if(s < 0)
+		return false;
+
+	sockaddr_t sa = listen_socket[s].sa;
+	if(sa.sa.sa_family == AF_INET)
+		sa.in.sin_port = 0;
+	else if(sa.sa.sa_family == AF_INET6)
+		sa.in6.sin6_port = 0;
+
+	if(bind(c->socket, &sa.sa, SALEN(sa.sa))) {
+		logger(DEBUG_CONNECTIONS, LOG_WARNING, "Can't bind outgoing socket: %s", strerror(errno));
+		return false;
+	}
+
+	return true;
+}
+
 int setup_listen_socket(const sockaddr_t *sa) {
 	int nfd;
 	char *addrstr;
@@ -481,6 +509,7 @@ begin:
 #endif
 
 		bind_to_interface(c->socket);
+		bind_to_address(c);
 	}
 
 	/* Connect */
@@ -565,7 +594,6 @@ void handle_new_meta_connection(void *data, int flags) {
 	// Check if we get many connections from the same host
 
 	static sockaddr_t prev_sa;
-	static time_t prev_time;
 	static int tarpit = -1;
 
 	if(tarpit >= 0) {
@@ -573,14 +601,25 @@ void handle_new_meta_connection(void *data, int flags) {
 		tarpit = -1;
 	}
 
-	if(prev_time == now.tv_sec && !sockaddrcmp_noport(&sa, &prev_sa)) {
-		// if so, keep the connection open but ignore it completely.
-		tarpit = fd;
-		return;
+	if(!sockaddrcmp_noport(&sa, &prev_sa)) {
+		static int samehost_burst;
+		static int samehost_burst_time;
+
+		if(now.tv_sec - samehost_burst_time > samehost_burst)
+			samehost_burst = 0;
+		else
+			samehost_burst -= now.tv_sec - samehost_burst_time;
+
+		samehost_burst_time = now.tv_sec;
+		samehost_burst++;
+
+		if(samehost_burst > max_connection_burst) {
+			tarpit = fd;
+			return;
+		}
 	}
 
 	memcpy(&prev_sa, &sa, sizeof sa);
-	prev_time = now.tv_sec;
 
 	// Check if we get many connections from different hosts