Re: tcpsvd - Allow only x connections from somebody/hour

* Ketil Froyn:

> On Wed, 2004-12-01 at 22:45, Clemens Fischer wrote:
>
>> *  data kept per IP:
>>    +  IP (a long number)
>>    +  last_seen (timestamp, long int)
>>    +  n (number of connections during monitored time period)
>
> How will you know when to decrease n?

it's right there in the outline:

   5.  time_diff < limit_time && n > limit_cons =>
           --i; last_seen = this_time; save db; quit;
   6.  time_diff > limit_time =>
           i = 1; last_seen = this_time; save db; exec;

so once a host having exceeded its allowance connects during the monitored
time period `t', its stored number-of-connections is reduced but it isn't
served.  should that IP connect again, it will be.

on the other hand, if the IP hasn't been seen for a while (or is entirely new,
for that matter), its counter is reset and the connection served.

> Something like this would probably need another running process that keeps
> the DB in memory, if you don't just put this functionality into tcpserver.

that is true, but neither tcpserver nor ipsvd implement it.  my thinking for
the database was a constant size hash allocated propably by "dd(1)" to try to
get one single fragment.  it might arguably better to use shared memory, but
you can equally well put the db on a memory filesystem, which makes it
simpler.

> A possible algorithm for max LIMITIPTO connections per LIMITIPTIME seconds
> (accept connection on DB error):
>
> 0) if LIMITIPTO == 0  or LIMITIPTIME == 0 goto 5
> 1) connect to LIMITIPDB
> 2) add (REMOTEIP,now)
> 3) N = count(REMOTEIP, LIMITIPTIME) counts tuples (REMOTEIP, ts)
>    where ts > now - LIMITIPTIME
> 4) if (N > LIMITIPTO) die
> 5) exec argv

here you need counting, which sounds "sequential".  if you just add entries
"somewhere" dropping least recently used ones, you get organisational overhead
(linking all info related to a particular IP, traversing the structure).  this
service ought to rely and benefit from a simple hash table keeping just a few
items.

  clemens