/*

 * Check whether connection should be accepted by MaxStartups.

 * Returns 0 if the connection is accepted. If the connection is refused,

 * returns 1 and attempts to send notification to client.

 * Logs when the MaxStartups condition is entered or exited, and periodically

 * while in that state.

 */

static int

drop_connection(int sock, int startups)

{

	char *laddr, *raddr;

	const char msg[] = "Exceeded MaxStartups\r\n";

	static time_t last_drop, first_drop;

	static u_int ndropped;

	LogLevel drop_level = SYSLOG_LEVEL_VERBOSE;

	time_t now;

	now = monotime();

	if (!should_drop_connection(startups)) {

		if (last_drop != 0 &&

		    startups < options.max_startups_begin - 1) {

			/* XXX maybe need better hysteresis here */

			logit("exited MaxStartups throttling after %s, "

			    "%u connections dropped",

			    fmt_interval((u_int)(now - first_drop)), ndropped);

			last_drop = 0;

		}

		return 0;

	}

#define SSHD_MAXSTARTUPS_LOG_INTERVAL	(5 * 60)

	if (last_drop == 0) {

		error("beginning MaxStartups throttling");

		drop_level = SYSLOG_LEVEL_INFO;

		first_drop = now;

		ndropped = 0;

	} else if (last_drop + SSHD_MAXSTARTUPS_LOG_INTERVAL < now) {

		/* Periodic logs */

		error("in MaxStartups throttling for %s, "

		    "%u connections dropped",

		    fmt_interval((u_int)(now - first_drop)), ndropped + 1);

		drop_level = SYSLOG_LEVEL_INFO;

	}

	last_drop = now;

	ndropped++;

	laddr = get_local_ipaddr(sock);

	raddr = get_peer_ipaddr(sock);

	do_log2(drop_level, "drop connection #%d from [%s]:%d on [%s]:%d "

	    "past MaxStartups", startups, raddr, get_peer_port(sock),

	    laddr, get_local_port(sock));

	free(laddr);

	free(raddr);

	/* best-effort notification to client */

	(void)write(sock, msg, sizeof(msg) - 1);

	return 1;

}