Mercurial > prosody-modules

comparison mod_c2s_conn_throttle/mod_c2s_conn_throttle.lua @ 5787:e79f9dec35c0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_c2s_conn_throttle: Reduce log level from error->info Our general policy is that "error" should never be triggerable by remote entities, and that it is always about something that requires admin intervention. This satisfies neither condition. The "warn" level can be used for unexpected events/behaviour triggered by remote entities, and this could qualify. However I don't think failed auth attempts are unexpected enough. I selected "info" because it is what is also used for other notable session lifecycle events.
author Matthew Wild <mwild1@gmail.com>
date Thu, 07 Dec 2023 15:46:50 +0000
parents 7dbde05b48a9
children
comparison
equal deleted inserted replaced
5786:076b79eb747f 5787:e79f9dec35c0
13 in_count[session.ip] = { t = time(), c = 1 } 13 in_count[session.ip] = { t = time(), c = 1 }
14 elseif in_count[session.ip] and session.type == "c2s_unauthed" then 14 elseif in_count[session.ip] and session.type == "c2s_unauthed" then
15 if in_count[session.ip].starttls_c then in_count[session.ip].c = in_count[session.ip].starttls_c else in_count[session.ip].c = in_count[session.ip].c + 1 end 15 if in_count[session.ip].starttls_c then in_count[session.ip].c = in_count[session.ip].starttls_c else in_count[session.ip].c = in_count[session.ip].c + 1 end
16 16
17 if in_count[session.ip].c > logins_count and time() - in_count[session.ip].t < throttle_time then 17 if in_count[session.ip].c > logins_count and time() - in_count[session.ip].t < throttle_time then
18 module:log("error", "Exceeded login count for %s, closing connection", session.ip) 18 module:log("info", "Exceeded login count for %s, closing connection", session.ip)
19 session:close{ condition = "policy-violation", text = "You exceeded the number of connections/logins allowed in "..throttle_time.." seconds, good bye." } 19 session:close{ condition = "policy-violation", text = "You exceeded the number of connections/logins allowed in "..throttle_time.." seconds, good bye." }
20 return true 20 return true
21 elseif time() - in_count[session.ip].t > throttle_time then 21 elseif time() - in_count[session.ip].t > throttle_time then
22 in_count[session.ip] = nil ; return 22 in_count[session.ip] = nil ; return
23 end 23 end