diff options
author | Jake McGinty <me@jake.su> | 2018-05-18 02:36:50 -0700 |
---|---|---|
committer | Jake McGinty <me@jake.su> | 2018-05-18 02:36:50 -0700 |
commit | eb5eac741ff529bc89a024f17200224a61114d64 (patch) | |
tree | 07f72740164492bca99242591ba850252eb86ba8 /src/interface/peer_server.rs | |
parent | tests: add peer stress test (diff) | |
download | wireguard-rs-eb5eac741ff529bc89a024f17200224a61114d64.tar.xz wireguard-rs-eb5eac741ff529bc89a024f17200224a61114d64.zip |
peer_server: fill in more scaffolding for rate limiter
Diffstat (limited to 'src/interface/peer_server.rs')
-rw-r--r-- | src/interface/peer_server.rs | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/src/interface/peer_server.rs b/src/interface/peer_server.rs index 255553f..13f5997 100644 --- a/src/interface/peer_server.rs +++ b/src/interface/peer_server.rs @@ -18,6 +18,7 @@ use tokio_core::reactor::Handle; use std::collections::VecDeque; use std::convert::TryInto; +use std::net::IpAddr; use std::rc::Rc; use std::time::Instant; @@ -187,6 +188,21 @@ impl PeerServer { let (mac_in, mac_out) = packet.split_at(116); self.cookie.verify_mac1(&mac_in[..], &mac_out[..16])?; + if self.under_load() { + let mac2_verified = match addr.ip() { + IpAddr::V4(ip) => self.cookie.verify_mac2(&packet, &ip.octets()).is_ok(), + IpAddr::V6(ip) => self.cookie.verify_mac2(&packet, &ip.octets()).is_ok(), + }; + + if !mac2_verified { + bail!("would send cookie request now"); + } + + if !self.rate_limiter.allow(&addr.ip()) { + bail!("rejected by rate limiter."); + } + } + debug!("got handshake initiation request (0x01)"); let handshake = Peer::process_incoming_handshake( |