Rate-limit connection attempts for "down" home servers

To only once per second.

diff --git a/src/main/listen.c b/src/main/listen.c
index cd2fbaa..a6fbb7c 100644 (file)
--- a/src/main/listen.c
+++ b/src/main/listen.c
@@ -2593,6 +2593,7 @@ static rad_listen_t *listen_alloc(TALLOC_CTX *ctx, RAD_LISTEN_TYPE type)
  */
 rad_listen_t *proxy_new_listener(home_server_t *home, int src_port)
 {
+       time_t now;
        rad_listen_t *this;
        listen_socket_t *sock;
        char buffer[256];
@@ -2606,6 +2607,12 @@ rad_listen_t *proxy_new_listener(home_server_t *home, int src_port)
                return NULL;
        }
 
+       now = time(NULL);
+       if (home->last_failed_open == now) {
+               WDEBUG("Suppressing attempt to open socket to 'down' home server");
+               return NULL;
+       }
+
        this = listen_alloc(mainconfig.config, RAD_LISTEN_PROXY);
 
        sock = this->data;
@@ -2623,7 +2630,7 @@ rad_listen_t *proxy_new_listener(home_server_t *home, int src_port)
        }
 
 #ifdef WITH_TCP
-       sock->opened = sock->last_packet = time(NULL);
+       sock->opened = sock->last_packet = now;
 
        if (home->proto == IPPROTO_TCP) {
                this->recv = proxy_socket_tcp_recv;
@@ -2637,11 +2644,12 @@ rad_listen_t *proxy_new_listener(home_server_t *home, int src_port)
                 */
                this->fd = fr_tcp_client_socket(&home->src_ipaddr,
                                                &home->ipaddr, home->port);
-#ifdef WITH_TLS
                if (home->tls) {
                        DEBUG("Trying SSL to port %d\n", home->port);
                        sock->ssn = tls_new_client_session(home->tls, this->fd);
                        if (!sock->ssn) {
+                               ERROR("Failed starting SSL to %s", buffer);
+                               home->last_failed_open = now;
                                listen_free(&this);
                                return NULL;
                        }
@@ -2649,15 +2657,15 @@ rad_listen_t *proxy_new_listener(home_server_t *home, int src_port)
                        this->recv = proxy_tls_recv;
                        this->send = proxy_tls_send;
                }
-#endif
        } else
 #endif
                this->fd = fr_socket(&home->src_ipaddr, src_port);
 
        if (this->fd < 0) {
                this->print(this, buffer,sizeof(buffer));
-               DEBUG("Failed opening client socket ::%s:: : %s",
+               ERROR("Failed opening client socket %s : %s",
                      buffer, fr_strerror());
+               home->last_failed_open = now;
                listen_free(&this);
                return NULL;
        }
@@ -2674,6 +2682,7 @@ rad_listen_t *proxy_new_listener(home_server_t *home, int src_port)
                                &sizeof_src) < 0) {
                        ERROR("Failed getting socket name: %s",
                               fr_syserror(errno));
+                       home->last_failed_open = now;
                        listen_free(&this);
                        return NULL;
                }
@@ -2681,6 +2690,7 @@ rad_listen_t *proxy_new_listener(home_server_t *home, int src_port)
                if (!fr_sockaddr2ipaddr(&src, sizeof_src,
                                        &sock->my_ipaddr, &sock->my_port)) {
                        ERROR("Socket has unsupported address family");
+                       home->last_failed_open = now;
                        listen_free(&this);
                        return NULL;
                }