Implement rate limiting in mbd, and fix some logging.

[nms] / mbd / mbd.pl

diff --git a/mbd/mbd.pl b/mbd/mbd.pl
index e5c2879e01b9310fe1b73becae6e1bd9743692f1..dcc25fe242e8bd843a1741b0821c9f81c7f4978e 100644 (file)
--- a/mbd/mbd.pl
+++ b/mbd/mbd.pl
@@ -4,6 +4,7 @@ use warnings;
 use Socket;
 use Net::CIDR;
 use Net::RawIP;
+use Time::HiRes;
 require './access_list.pl';
 require './nets.pl';
 require './mbd.pm';
@@ -16,6 +17,33 @@ sub fhbits {
        return $bits;
 }
 
+# used for rate limiting
+my %last_sent = ();
+
+my %cidrcache = ();
+sub cache_cidrlookup {
+       my ($addr, $net) = @_;
+       my $key = $addr . " " . $net;
+
+       if (!exists($cidrcache{$key})) {
+               $cidrcache{$key} = Net::CIDR::cidrlookup($addr, $net);
+       }
+       return $cidrcache{$key};
+}
+
+my %rangecache = ();
+sub cache_cidrrange {
+       my ($net) = @_;
+
+       if (!exists($rangecache{$net})) {
+               ($rangecache{$net}) = Net::CIDR::cidr2range($net);
+       }
+
+       return $rangecache{$net};
+}
+
+open LOG, ">>", "mbd.log";
+
 my @ports = mbd::find_all_ports();
 
 # Open a socket for each port
@@ -47,31 +75,50 @@ while (1) {
                my ($dport, $daddr) = sockaddr_in(getsockname($sock));
                my $size = length($data);
 
+               # Rate limiting
+               my $now = [Time::HiRes::gettimeofday];
+               if (exists($last_sent{$saddr}{$dport})) {
+                       my $elapsed = Time::HiRes::tv_interval($last_sent{$saddr}{$dport}, $now);
+                       if ($elapsed < 1.0) {
+                               print LOG "$dport $size 2\n";
+                               print inet_ntoa($saddr), ", $dport, $size bytes => rate-limited ($elapsed secs since last)\n";
+                       }
+                       next;
+               }
+
                # We don't get the packet's destination address, but I guess this should do...
                # Check against the ACL.
                my $pass = 0;
                for my $rule (@Config::access_list) {
-                       if (mbd::match_ranges($dport, $rule->{'ports'}) &&
-                           mbd::match_ranges($size, $rule->{'sizes'})) {
-                               $pass = 1;
+                       next unless (mbd::match_ranges($dport, $rule->{'ports'}));
+                       next unless (mbd::match_ranges($size, $rule->{'sizes'}));
+
+                       if ($rule->{'filter'}) {
+                               next unless ($rule->{'filter'}($data));
                        }
+
+                       $pass = 1;
+                       last;
                }
 
+               print LOG "$dport $size $pass\n";
+
                if (!$pass) {
-                       print "$dport, $size bytes => filtered\n";
+                       print inet_ntoa($saddr), ", $dport, $size bytes => filtered\n";
+                       next;
                }
 
-               next unless $pass;
+               $last_sent{$saddr}{$dport} = $now;
+
+               my $num_nets = 0;
 
                for my $net (@Config::networks) {
-                       next if (Net::CIDR::cidrlookup(inet_ntoa($saddr), $net));
+                       next if (cache_cidrlookup(inet_ntoa($saddr), $net));
 
-                       my ($range) = Net::CIDR::cidr2range($net);
+                       my ($range) = cache_cidrrange($net);
                        $range =~ /-(.*?)$/;
                        my $broadcast = $1;
 
-                       print inet_ntoa($saddr), ", $dport, $size bytes => $broadcast\n";
-
                        $sendsock->set({
                                ip => {
                                        saddr => inet_ntoa($saddr),
@@ -84,7 +131,9 @@ while (1) {
                                }
                        });
                        $sendsock->send;
+                       ++$num_nets;
                }
+               print inet_ntoa($saddr), ", $dport, $size bytes => ($num_nets networks)\n";
        }
 }