dark/zerotiertspu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add a rate limiting circuit breaker to the network controller to prevent flooding attacks and race conditions.

Browse source
This commit is contained in:
Adam Ierymenko 2015-07-23 10:10:17 -07:00
parent 3ba54c7e35
commit b3516c599b
4 changed files with 20 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
controller/SqliteNetworkController.cpp
View file

@ -64,6 +64,10 @@
// API version reported via JSON control plane
#define ZT_NETCONF_CONTROLLER_API_VERSION 1
// Drop requests for a given peer and network ID that occur more frequently
// than this (ms).
#define ZT_NETCONF_MIN_REQUEST_PERIOD 5000
namespace ZeroTier {
namespace {
@ -316,6 +320,15 @@ NetworkController::ResultCode SqliteNetworkController::doNetworkConfigRequest(co
return NetworkController::NETCONF_QUERY_INTERNAL_SERVER_ERROR;
}
// Check rate limit
{
uint64_t &lrt = _lastRequestTime[std::pair<Address,uint64_t>(identity.address(),nwid)];
uint64_t lrt2 = lrt;
if (((lrt = OSUtils::now()) - lrt2) <= ZT_NETCONF_MIN_REQUEST_PERIOD)
return NetworkController::NETCONF_QUERY_IGNORE;
}
NetworkRecord network;
memset(&network,0,sizeof(network));
Utils::snprintf(network.id,sizeof(network.id),"%.16llx",(unsigned long long)nwid);