140 lines
4.3 KiB
C++
140 lines
4.3 KiB
C++
//========= Copyright Valve Corporation, All rights reserved. ============//
|
|
//
|
|
// Purpose: Handles all the functions for implementing remote access to the engine
|
|
//
|
|
//=============================================================================//
|
|
|
|
#include "sv_ipratelimit.h"
|
|
#include "filesystem.h"
|
|
#include "sv_log.h"
|
|
|
|
static ConVar sv_logblocks("sv_logblocks", "0", 0, "If true when log when a query is blocked (can cause very large log files)");
|
|
|
|
|
|
//-----------------------------------------------------------------------------
|
|
// Purpose: Constructor
|
|
//-----------------------------------------------------------------------------
|
|
CIPRateLimit::CIPRateLimit(ConVar *maxSec, ConVar *maxWindow, ConVar *maxSecGlobal)
|
|
: m_IPTree( 0, START_TREE_SIZE, LessIP),
|
|
m_maxSec( maxSec ),
|
|
m_maxWindow( maxWindow ),
|
|
m_maxSecGlobal( maxSecGlobal )
|
|
{
|
|
m_iGlobalCount = 0;
|
|
m_lLastTime = -1;
|
|
m_flFlushTime = 0;
|
|
}
|
|
|
|
//-----------------------------------------------------------------------------
|
|
// Purpose: Destructor
|
|
//-----------------------------------------------------------------------------
|
|
CIPRateLimit::~CIPRateLimit()
|
|
{
|
|
}
|
|
|
|
//-----------------------------------------------------------------------------
|
|
// Purpose: sort func for rb tree
|
|
//-----------------------------------------------------------------------------
|
|
bool CIPRateLimit::LessIP( const struct CIPRateLimit::iprate_s &lhs, const struct CIPRateLimit::iprate_s &rhs )
|
|
{
|
|
return ( lhs.ip < rhs.ip );
|
|
}
|
|
|
|
//-----------------------------------------------------------------------------
|
|
// Purpose: return false and potentially log a warning if this IP has exceeded limits
|
|
//-----------------------------------------------------------------------------
|
|
bool CIPRateLimit::CheckIP( netadr_t adr )
|
|
{
|
|
bool ret = CheckIPInternal(adr);
|
|
if ( !ret && sv_logblocks.GetBool() == true )
|
|
{
|
|
g_Log.Printf("Traffic from %s was blocked for exceeding rate limits\n", adr.ToString() );
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
//-----------------------------------------------------------------------------
|
|
// Purpose: return false if this IP has exceeded limits
|
|
//-----------------------------------------------------------------------------
|
|
bool CIPRateLimit::CheckIPInternal( netadr_t adr )
|
|
{
|
|
// check the global count first in case we are being spammed
|
|
m_iGlobalCount++;
|
|
long curTime = (long)Plat_FloatTime();
|
|
|
|
if( (curTime - m_lLastTime) > m_maxWindow->GetFloat() )
|
|
{
|
|
m_lLastTime = curTime;
|
|
m_iGlobalCount = 1;
|
|
}
|
|
|
|
float query_rate = static_cast<float>( m_iGlobalCount ) / m_maxWindow->GetFloat(); // add one so the bottom is never zero
|
|
if( m_maxSecGlobal->GetFloat() > FLT_EPSILON && query_rate > m_maxSecGlobal->GetFloat() )
|
|
{
|
|
return false;
|
|
}
|
|
|
|
|
|
// check the per ip rate (do this first, so one person dosing doesn't add to the global max rate
|
|
ip_t clientIP;
|
|
memcpy( &clientIP, adr.ip, sizeof(ip_t) );
|
|
|
|
if( m_IPTree.Count() > MAX_TREE_SIZE && curTime > ( m_flFlushTime + FLUSH_TIMEOUT/4 ) ) // if we have stored too many items
|
|
{
|
|
m_flFlushTime = curTime;
|
|
ip_t tmp = m_IPTree.LastInorder(); // we step BACKWARD's through the tree
|
|
int i = m_IPTree.FirstInorder();
|
|
while( (m_IPTree.Count() > (2*MAX_TREE_SIZE)/3) && i < m_IPTree.MaxElement() ) // trim 1/3 the entries from the tree and only traverse the max nodes
|
|
{
|
|
if ( !m_IPTree.IsValidIndex( tmp ) )
|
|
break;
|
|
|
|
if ( (curTime - m_IPTree[ tmp ].lastTime) > FLUSH_TIMEOUT &&
|
|
m_IPTree[ tmp ].ip != clientIP )
|
|
{
|
|
ip_t removeIPT = tmp;
|
|
tmp = m_IPTree.PrevInorder( tmp );
|
|
m_IPTree.RemoveAt( removeIPT );
|
|
continue;
|
|
}
|
|
i++;
|
|
tmp = m_IPTree.PrevInorder( tmp );
|
|
}
|
|
}
|
|
|
|
// now find the entry and check if its within our rate limits
|
|
struct iprate_s findEntry = { clientIP };
|
|
ip_t entry = m_IPTree.Find( findEntry );
|
|
|
|
if( m_IPTree.IsValidIndex( entry ) )
|
|
{
|
|
m_IPTree[ entry ].count++; // a new hit
|
|
|
|
if( (curTime - m_IPTree[ entry ].lastTime) > m_maxWindow->GetFloat() )
|
|
{
|
|
m_IPTree[ entry ].lastTime = curTime;
|
|
m_IPTree[ entry ].count = 1;
|
|
}
|
|
else
|
|
{
|
|
float flQueryRate = static_cast<float>( m_IPTree[ entry ].count) / m_maxWindow->GetFloat(); // add one so the bottom is never zero
|
|
if( flQueryRate > m_maxSec->GetFloat() )
|
|
{
|
|
return false;
|
|
}
|
|
}
|
|
}
|
|
else
|
|
{
|
|
// not found, insert this new guy
|
|
struct iprate_s newEntry;
|
|
newEntry.count = 1;
|
|
newEntry.lastTime = curTime;
|
|
newEntry.ip = clientIP;
|
|
m_IPTree.Insert( newEntry );
|
|
}
|
|
|
|
|
|
return true;
|
|
}
|