49 lines
1.7 KiB
C
49 lines
1.7 KiB
C
#ifndef IP_BAN_H
|
|
#define IP_BAN_H
|
|
|
|
// IP Auth Failure Ban System
|
|
//
|
|
// Tracks auth failures per IP address and temporarily bans IPs that repeatedly
|
|
// fail NIP-42 authentication. Uses an in-memory fixed-size hash table — no
|
|
// database writes, no root required, no persistent state.
|
|
//
|
|
// Config keys (all read from the config table at runtime):
|
|
// auth_fail_ban_enabled bool default: true (0 = disabled)
|
|
// auth_fail_ban_threshold int default: 3 (failures before ban)
|
|
// auth_fail_window_sec int default: 60 (window to count failures)
|
|
// auth_fail_ban_duration_sec int default: 300 (initial ban duration, doubles each time)
|
|
|
|
#include <time.h>
|
|
|
|
// Maximum number of IPs tracked simultaneously (fixed-size, no malloc)
|
|
#define IP_BAN_TABLE_SIZE 4096
|
|
|
|
// Initialize the IP ban table (call once at startup)
|
|
void ip_ban_init(void);
|
|
|
|
// Check if an IP is currently banned.
|
|
// Returns 1 if banned (connection should be rejected), 0 if allowed.
|
|
int ip_ban_is_banned(const char* ip);
|
|
|
|
// Record an auth failure for an IP.
|
|
// Called when a connection is closed due to auth timeout.
|
|
// May trigger a ban if the threshold is exceeded.
|
|
void ip_ban_record_failure(const char* ip);
|
|
|
|
// Record a successful auth for an IP.
|
|
// Clears any failure count for this IP (reward good behavior).
|
|
void ip_ban_record_success(const char* ip);
|
|
|
|
// Periodic cleanup: expire old entries (call from the connection age checker).
|
|
void ip_ban_cleanup(void);
|
|
|
|
// Get stats for logging/monitoring
|
|
int ip_ban_get_banned_count(void);
|
|
int ip_ban_get_tracked_count(void);
|
|
|
|
// Emit a periodic WARN-level log summary of banned IPs (every 5 minutes).
|
|
// Call from the connection age checker timer.
|
|
void ip_ban_log_stats(void);
|
|
|
|
#endif // IP_BAN_H
|