From 515ac2951d767bdb712c4997010045715902e6ab Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Thu, 28 Mar 2019 22:24:36 +0000 Subject: p2p: store network address directly in blocked host list rather than their string representation --- src/p2p/net_node.inl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'src/p2p/net_node.inl') diff --git a/src/p2p/net_node.inl b/src/p2p/net_node.inl index a5800df5e..37a3f393d 100644 --- a/src/p2p/net_node.inl +++ b/src/p2p/net_node.inl @@ -158,7 +158,7 @@ namespace nodetool bool node_server::is_remote_host_allowed(const epee::net_utils::network_address &address) { CRITICAL_REGION_LOCAL(m_blocked_hosts_lock); - auto it = m_blocked_hosts.find(address.host_str()); + auto it = m_blocked_hosts.find(address); if(it == m_blocked_hosts.end()) return true; if(time(nullptr) >= it->second) @@ -184,7 +184,7 @@ namespace nodetool limit = std::numeric_limits::max(); else limit = now + seconds; - m_blocked_hosts[addr.host_str()] = limit; + m_blocked_hosts[addr] = limit; // drop any connection to that address. This should only have to look into // the zone related to the connection, but really make sure everything is @@ -214,7 +214,7 @@ namespace nodetool bool node_server::unblock_host(const epee::net_utils::network_address &address) { CRITICAL_REGION_LOCAL(m_blocked_hosts_lock); - auto i = m_blocked_hosts.find(address.host_str()); + auto i = m_blocked_hosts.find(address); if (i == m_blocked_hosts.end()) return false; m_blocked_hosts.erase(i); -- cgit v1.2.3 From 65c40049633f0c5db3c24af8716bb683520f368c Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Fri, 29 Mar 2019 10:47:53 +0000 Subject: allow blocking whole subnets --- src/p2p/net_node.inl | 104 +++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 96 insertions(+), 8 deletions(-) (limited to 'src/p2p/net_node.inl') diff --git a/src/p2p/net_node.inl b/src/p2p/net_node.inl index 37a3f393d..f8011ec0e 100644 --- a/src/p2p/net_node.inl +++ b/src/p2p/net_node.inl @@ -155,19 +155,55 @@ namespace nodetool } //----------------------------------------------------------------------------------- template - bool node_server::is_remote_host_allowed(const epee::net_utils::network_address &address) + bool node_server::is_remote_host_allowed(const epee::net_utils::network_address &address, time_t *t) { CRITICAL_REGION_LOCAL(m_blocked_hosts_lock); + + const time_t now = time(nullptr); + + // look in the hosts list auto it = m_blocked_hosts.find(address); - if(it == m_blocked_hosts.end()) - return true; - if(time(nullptr) >= it->second) + if (it != m_blocked_hosts.end()) { - m_blocked_hosts.erase(it); - MCLOG_CYAN(el::Level::Info, "global", "Host " << address.host_str() << " unblocked."); - return true; + if (now >= it->second) + { + m_blocked_hosts.erase(it); + MCLOG_CYAN(el::Level::Info, "global", "Host " << address.host_str() << " unblocked."); + it = m_blocked_hosts.end(); + } + else + { + if (t) + *t = it->second - now; + return false; + } } - return false; + + // manually loop in subnets + if (address.get_type_id() == epee::net_utils::address_type::ipv4) + { + auto ipv4_address = address.template as(); + std::map::iterator it; + for (it = m_blocked_subnets.begin(); it != m_blocked_subnets.end(); ) + { + if (now >= it->second) + { + it = m_blocked_subnets.erase(it); + MCLOG_CYAN(el::Level::Info, "global", "Subnet " << it->first.host_str() << " unblocked."); + continue; + } + if (it->first.matches(ipv4_address)) + { + if (t) + *t = it->second - now; + return false; + } + ++it; + } + } + + // not found in hosts or subnets, allowed + return true; } //----------------------------------------------------------------------------------- template @@ -223,6 +259,58 @@ namespace nodetool } //----------------------------------------------------------------------------------- template + bool node_server::block_subnet(const epee::net_utils::ipv4_network_subnet &subnet, time_t seconds) + { + const time_t now = time(nullptr); + + CRITICAL_REGION_LOCAL(m_blocked_hosts_lock); + time_t limit; + if (now > std::numeric_limits::max() - seconds) + limit = std::numeric_limits::max(); + else + limit = now + seconds; + m_blocked_subnets[subnet] = limit; + + // drop any connection to that subnet. This should only have to look into + // the zone related to the connection, but really make sure everything is + // swept ... + std::vector conns; + for(auto& zone : m_network_zones) + { + zone.second.m_net_server.get_config_object().foreach_connection([&](const p2p_connection_context& cntxt) + { + if (cntxt.m_remote_address.get_type_id() != epee::net_utils::ipv4_network_address::get_type_id()) + return true; + auto ipv4_address = cntxt.m_remote_address.template as(); + if (subnet.matches(ipv4_address)) + { + conns.push_back(cntxt.m_connection_id); + } + return true; + }); + for (const auto &c: conns) + zone.second.m_net_server.get_config_object().close(c); + + conns.clear(); + } + + MCLOG_CYAN(el::Level::Info, "global", "Subnet " << subnet.host_str() << " blocked."); + return true; + } + //----------------------------------------------------------------------------------- + template + bool node_server::unblock_subnet(const epee::net_utils::ipv4_network_subnet &subnet) + { + CRITICAL_REGION_LOCAL(m_blocked_hosts_lock); + auto i = m_blocked_subnets.find(subnet); + if (i == m_blocked_subnets.end()) + return false; + m_blocked_subnets.erase(i); + MCLOG_CYAN(el::Level::Info, "global", "Subnet " << subnet.host_str() << " unblocked."); + return true; + } + //----------------------------------------------------------------------------------- + template bool node_server::add_host_fail(const epee::net_utils::network_address &address) { if(!address.is_blockable()) -- cgit v1.2.3