X-Git-Url: https://www.tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Fnet_socket.c;h=a41b887de35a29971c0fd6764a0dfed1e5666f97;hb=e717e424c22233aa728b75c4c8bb047e13b0107a;hp=0ee365538be3c8248b721d8a70c934b0d85b7b6d;hpb=f9ab8e266b93aa3be772374ef4a8fdb06e376568;p=tinc

diff --git a/src/net_socket.c b/src/net_socket.c
index 0ee36553..a41b887d 100644
--- a/src/net_socket.c
+++ b/src/net_socket.c
@@ -45,6 +45,7 @@ int maxtimeout = 900;
 int seconds_till_retry = 5;
 int udp_rcvbuf = 0;
 int udp_sndbuf = 0;
+int max_connection_burst = 100;
 
 listen_socket_t listen_socket[MAXSOCKETS];
 int listen_sockets;
@@ -112,6 +113,34 @@ static bool bind_to_interface(int sd) {
 	return true;
 }
 
+static bool bind_to_address(connection_t *c) {
+	int s = -1;
+
+	for(int i = 0; i < listen_sockets && listen_socket[i].bindto; i++) {
+		if(listen_socket[i].sa.sa.sa_family != c->address.sa.sa_family)
+			continue;
+		if(s >= 0)
+			return false;
+		s = i;
+	}
+
+	if(s < 0)
+		return false;
+
+	sockaddr_t sa = listen_socket[s].sa;
+	if(sa.sa.sa_family == AF_INET)
+		sa.in.sin_port = 0;
+	else if(sa.sa.sa_family == AF_INET6)
+		sa.in6.sin6_port = 0;
+
+	if(bind(c->socket, &sa.sa, SALEN(sa.sa))) {
+		logger(DEBUG_CONNECTIONS, LOG_WARNING, "Can't bind outgoing socket: %s", strerror(errno));
+		return false;
+	}
+
+	return true;
+}
+
 int setup_listen_socket(const sockaddr_t *sa) {
 	int nfd;
 	char *addrstr;
@@ -294,7 +323,7 @@ void retry_outgoing(outgoing_t *outgoing) {
 void finish_connecting(connection_t *c) {
 	logger(DEBUG_CONNECTIONS, LOG_INFO, "Connected to %s (%s)", c->name, c->hostname);
 
-	c->last_ping_time = time(NULL);
+	c->last_ping_time = now.tv_sec;
 	c->status.connecting = false;
 
 	send_id(c);
@@ -480,6 +509,7 @@ begin:
 #endif
 
 		bind_to_interface(c->socket);
+		bind_to_address(c);
 	}
 
 	/* Connect */
@@ -508,7 +538,7 @@ begin:
 	c->outdigest = myself->connection->outdigest;
 	c->outmaclength = myself->connection->outmaclength;
 	c->outcompression = myself->connection->outcompression;
-	c->last_ping_time = time(NULL);
+	c->last_ping_time = now.tv_sec;
 
 	connection_add(c);
 
@@ -517,6 +547,39 @@ begin:
 	return true;
 }
 
+// Find edges pointing to this node, and use them to build a list of unique, known addresses.
+static struct addrinfo *get_known_addresses(node_t *n) {
+	struct addrinfo *ai = NULL;
+
+	for splay_each(edge_t, e, n->edge_tree) {
+		if(!e->reverse)
+			continue;
+
+		bool found = false;
+		for(struct addrinfo *aip = ai; aip; aip = aip->ai_next) {
+			if(!sockaddrcmp(&e->reverse->address, (sockaddr_t *)aip->ai_addr)) {
+				found = true;
+				break;
+			}
+		}
+		if(found)
+			continue;
+
+		struct addrinfo *nai = xzalloc(sizeof *nai);
+		if(ai)
+			ai->ai_next = nai;
+		ai = nai;
+		ai->ai_family = e->reverse->address.sa.sa_family;
+		ai->ai_socktype = SOCK_STREAM;
+		ai->ai_protocol = IPPROTO_TCP;
+		ai->ai_addrlen = SALEN(e->reverse->address.sa);
+		ai->ai_addr = xmalloc(ai->ai_addrlen);
+		memcpy(ai->ai_addr, &e->reverse->address, ai->ai_addrlen);
+	}
+
+	return ai;
+}
+
 void setup_outgoing_connection(outgoing_t *outgoing) {
 	timeout_del(&outgoing->ev);
 
@@ -534,8 +597,12 @@ void setup_outgoing_connection(outgoing_t *outgoing) {
 	outgoing->cfg = lookup_config(outgoing->config_tree, "Address");
 
 	if(!outgoing->cfg) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "No address specified for %s", outgoing->name);
-		return;
+		if(n)
+			outgoing->aip = outgoing->ai = get_known_addresses(n);
+		if(!outgoing->ai) {
+			logger(DEBUG_ALWAYS, LOG_ERR, "No address known for %s", outgoing->name);
+			return;
+		}
 	}
 
 	do_outgoing_connection(outgoing);
@@ -561,6 +628,57 @@ void handle_new_meta_connection(void *data, int flags) {
 
 	sockaddrunmap(&sa);
 
+	// Check if we get many connections from the same host
+
+	static sockaddr_t prev_sa;
+	static int tarpit = -1;
+
+	if(tarpit >= 0) {
+		closesocket(tarpit);
+		tarpit = -1;
+	}
+
+	if(!sockaddrcmp_noport(&sa, &prev_sa)) {
+		static int samehost_burst;
+		static int samehost_burst_time;
+
+		if(now.tv_sec - samehost_burst_time > samehost_burst)
+			samehost_burst = 0;
+		else
+			samehost_burst -= now.tv_sec - samehost_burst_time;
+
+		samehost_burst_time = now.tv_sec;
+		samehost_burst++;
+
+		if(samehost_burst > max_connection_burst) {
+			tarpit = fd;
+			return;
+		}
+	}
+
+	memcpy(&prev_sa, &sa, sizeof sa);
+
+	// Check if we get many connections from different hosts
+
+	static int connection_burst;
+	static int connection_burst_time;
+
+	if(now.tv_sec - connection_burst_time > connection_burst)
+		connection_burst = 0;
+	else
+		connection_burst -= now.tv_sec - connection_burst_time;
+
+	connection_burst_time = now.tv_sec;
+	connection_burst++;
+
+	if(connection_burst >= max_connection_burst) {
+		connection_burst = max_connection_burst;
+		tarpit = fd;
+		return;
+	}
+
+	// Accept the new connection
+
 	c = new_connection();
 	c->name = xstrdup("<unknown>");
 	c->outcipher = myself->connection->outcipher;
@@ -571,7 +689,7 @@ void handle_new_meta_connection(void *data, int flags) {
 	c->address = sa;
 	c->hostname = sockaddr2hostname(&sa);
 	c->socket = fd;
-	c->last_ping_time = time(NULL);
+	c->last_ping_time = now.tv_sec;
 
 	logger(DEBUG_CONNECTIONS, LOG_NOTICE, "Connection from %s", c->hostname);
 
@@ -610,7 +728,7 @@ void handle_new_unix_connection(void *data, int flags) {
 	c->address = sa;
 	c->hostname = xstrdup("localhost port unix");
 	c->socket = fd;
-	c->last_ping_time = time(NULL);
+	c->last_ping_time = now.tv_sec;
 
 	logger(DEBUG_CONNECTIONS, LOG_NOTICE, "Connection from %s", c->hostname);
 
@@ -674,7 +792,7 @@ void try_outgoing_connections(void) {
 		}
 
 		if(!found) {
-			outgoing_t *outgoing = xmalloc_and_zero(sizeof *outgoing);
+			outgoing_t *outgoing = xzalloc(sizeof *outgoing);
 			outgoing->name = name;
 			list_insert_tail(outgoing_list, outgoing);
 			setup_outgoing_connection(outgoing);