Method CheckConnection

server/auth/ratelimit.go:76–101

CheckConnection checks if a connection from the given address should be allowed. Returns an error message if the connection should be rejected, or empty string if allowed.

(addr net.Addr)

// CheckConnection checks if a connection from the given address should be allowed.
// Returns an error message if the connection should be rejected, or empty string if allowed.
func (rl *RateLimiter) CheckConnection(addr net.Addr) string {
	ip := extractIP(addr)
	if ip == "" {
		return ""
	}

	rl.mu.Lock()
	defer rl.mu.Unlock()

	if rl.config.MaxConnections > 0 && rl.totalActiveConns >= rl.config.MaxConnections {
		return "too many concurrent connections"
	}

	record := rl.getOrCreateRecord(ip)

	if !record.bannedUntil.IsZero() && time.Now().Before(record.bannedUntil) {
		remaining := time.Until(record.bannedUntil).Round(time.Second)
		return "too many failed authentication attempts, try again in " + remaining.String()
	}

	if rl.config.MaxConnectionsPerIP > 0 && record.activeConns >= rl.config.MaxConnectionsPerIP {
		return "too many connections from your IP address"
	}

	return ""
}

// RegisterConnection records a new connection from the given address.
// Returns true if the connection is allowed, false otherwise.