From 88a908974b0b2e9c7eee8ad9a8b0b4432e95d167 Mon Sep 17 00:00:00 2001
From: Dmitry Kozlov <xeb@mail.ru>
Date: Tue, 18 Apr 2017 20:42:32 +0300
Subject: implemented session count limiting
new config option:
[common]
max-sessions=N
If set then accel-pppd stops reply to new connection requests if total number of sessions (active and starting) is reached specified limit.
---
accel-pppd/accel-ppp.conf | 1 +
accel-pppd/ctrl/ipoe/ipoe.c | 9 +++++++++
accel-pppd/ctrl/l2tp/l2tp.c | 9 +++++++++
accel-pppd/ctrl/pppoe/pppoe.c | 6 ++++++
accel-pppd/ctrl/pptp/pptp.c | 7 ++++++-
accel-pppd/include/ap_session.h | 1 +
accel-pppd/session.c | 11 +++++++++++
7 files changed, 43 insertions(+), 1 deletion(-)
diff --git a/accel-pppd/accel-ppp.conf b/accel-pppd/accel-ppp.conf
index 98ca8850..49466b1c 100644
--- a/accel-pppd/accel-ppp.conf
+++ b/accel-pppd/accel-ppp.conf
@@ -40,6 +40,7 @@ thread-count=4
#single-session=replace
#sid-case=upper
#sid-source=seq
+#max-sessions=1000
[ppp]
verbose=1
diff --git a/accel-pppd/ctrl/ipoe/ipoe.c b/accel-pppd/ctrl/ipoe/ipoe.c
index b8aba6c9..46b6defb 100644
--- a/accel-pppd/ctrl/ipoe/ipoe.c
+++ b/accel-pppd/ctrl/ipoe/ipoe.c
@@ -1241,6 +1241,12 @@ static struct ipoe_session *ipoe_session_create_dhcpv4(struct ipoe_serv *serv, s
int dlen = 0;
uint8_t *ptr = NULL;
+ if (ap_shutdown)
+ return NULL;
+
+ if (conf_max_sessions && ap_session_stat.active + ap_session_stat.starting > conf_max_sessions)
+ return NULL;
+
ses = ipoe_session_alloc(serv->ifname);
if (!ses)
return NULL;
@@ -1884,6 +1890,9 @@ static struct ipoe_session *ipoe_session_create_up(struct ipoe_serv *serv, struc
if (ap_shutdown)
return NULL;
+ if (conf_max_sessions && ap_session_stat.active + ap_session_stat.starting > conf_max_sessions)
+ return NULL;
+
if (l4_redirect_list_check(saddr))
return NULL;
diff --git a/accel-pppd/ctrl/l2tp/l2tp.c b/accel-pppd/ctrl/l2tp/l2tp.c
index bb3df4d4..6399655e 100644
--- a/accel-pppd/ctrl/l2tp/l2tp.c
+++ b/accel-pppd/ctrl/l2tp/l2tp.c
@@ -2737,6 +2737,9 @@ static int l2tp_recv_SCCRQ(const struct l2tp_serv_t *serv,
return 0;
}
+ if (conf_max_sessions && ap_session_stat.active + ap_session_stat.starting > conf_max_sessions)
+ return 0;
+
if (triton_module_loaded("connlimit")
&& connlimit_check(cl_key_from_ipv4(pack->addr.sin_addr.s_addr))) {
log_warn("l2tp: connection limits reached,"
@@ -3263,6 +3266,9 @@ static int l2tp_recv_ICRQ(struct l2tp_conn_t *conn,
return 0;
}
+ if (conf_max_sessions && ap_session_stat.active + ap_session_stat.starting > conf_max_sessions)
+ return 0;
+
if (triton_module_loaded("connlimit")
&& connlimit_check(cl_key_from_ipv4(conn->peer_addr.sin_addr.s_addr))) {
log_tunnel(log_warn, conn, "connection limits reached,"
@@ -3563,6 +3569,9 @@ static int l2tp_recv_OCRQ(struct l2tp_conn_t *conn,
return 0;
}
+ if (conf_max_sessions && ap_session_stat.active + ap_session_stat.starting > conf_max_sessions)
+ return 0;
+
if (triton_module_loaded("connlimit")
&& connlimit_check(cl_key_from_ipv4(conn->peer_addr.sin_addr.s_addr))) {
log_tunnel(log_warn, conn, "connection limits reached,"
diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c
index ff6b76f2..520c4f1b 100644
--- a/accel-pppd/ctrl/pppoe/pppoe.c
+++ b/accel-pppd/ctrl/pppoe/pppoe.c
@@ -950,6 +950,9 @@ static void pppoe_recv_PADI(struct pppoe_serv_t *serv, uint8_t *pack, int size)
if (ap_shutdown || pado_delay == -1)
return;
+ if (conf_max_sessions && ap_session_stat.active + ap_session_stat.starting > conf_max_sessions)
+ return;
+
if (check_padi_limit(serv, ethhdr->h_source)) {
__sync_add_and_fetch(&stat_PADI_drop, 1);
if (conf_verbose) {
@@ -1069,6 +1072,9 @@ static void pppoe_recv_PADR(struct pppoe_serv_t *serv, uint8_t *pack, int size)
if (ap_shutdown)
return;
+ if (conf_max_sessions && ap_session_stat.active + ap_session_stat.starting > conf_max_sessions)
+ return;
+
if (!memcmp(ethhdr->h_dest, bc_addr, ETH_ALEN)) {
if (conf_verbose)
log_warn("pppoe: discard PADR (destination address is broadcast)\n");
diff --git a/accel-pppd/ctrl/pptp/pptp.c b/accel-pppd/ctrl/pptp/pptp.c
index 4aba5767..c8731ca7 100644
--- a/accel-pppd/ctrl/pptp/pptp.c
+++ b/accel-pppd/ctrl/pptp/pptp.c
@@ -648,9 +648,14 @@ static int pptp_connect(struct triton_md_handler_t *h)
continue;
}
+ if (conf_max_sessions && ap_session_stat.active + ap_session_stat.starting > conf_max_sessions) {
+ close(sock);
+ continue;
+ }
+
if (triton_module_loaded("connlimit") && connlimit_check(cl_key_from_ipv4(addr.sin_addr.s_addr))) {
close(sock);
- return 0;
+ continue;
}
log_info2("pptp: new connection from %s\n", inet_ntoa(addr.sin_addr));
diff --git a/accel-pppd/include/ap_session.h b/accel-pppd/include/ap_session.h
index 82e7e8c6..421360db 100644
--- a/accel-pppd/include/ap_session.h
+++ b/accel-pppd/include/ap_session.h
@@ -130,6 +130,7 @@ extern int sock_fd;
extern int sock6_fd;
extern int urandom_fd;
extern struct ap_session_stat ap_session_stat;
+extern int conf_max_sessions;
void ap_session_init(struct ap_session *ses);
void ap_session_set_ifindex(struct ap_session *ses);
diff --git a/accel-pppd/session.c b/accel-pppd/session.c
index 730a57aa..ca133ee2 100644
--- a/accel-pppd/session.c
+++ b/accel-pppd/session.c
@@ -34,6 +34,7 @@ static int conf_single_session = -1;
static int conf_sid_source;
static int conf_seq_save_timeout = 10;
static const char *conf_seq_file;
+int conf_max_sessions;
pthread_rwlock_t __export ses_lock = PTHREAD_RWLOCK_INITIALIZER;
__export LIST_HEAD(ses_list);
@@ -76,6 +77,10 @@ void __export ap_session_set_ifindex(struct ap_session *ses)
ses->acct_tx_packets_i = stats.tx_packets;
ses->acct_rx_bytes_i = stats.rx_bytes;
ses->acct_tx_bytes_i = stats.tx_bytes;
+ ses->acct_rx_bytes = 0;
+ ses->acct_tx_bytes = 0;
+ ses->acct_input_gigawords = 0;
+ ses->acct_output_gigawords = 0;
}
}
@@ -511,6 +516,12 @@ static void load_config(void)
conf_seq_file = conf_get_opt("common", "seq-file");
if (!conf_seq_file)
conf_seq_file = "/var/lib/accel-ppp/seq";
+
+ opt = conf_get_opt("common", "max-sessions");
+ if (opt)
+ conf_max_sessions = atoi(opt);
+ else
+ conf_max_sessions = 0;
}
static void init(void)
--
cgit v1.2.3