Jeff Trawick wrote:
On Wed, Jul 1, 2009 at 5:12 AM, Nick Kew <[email protected] <mailto:[email protected]>> wrote:fredk2 wrote: Hi Nick, I looked at the code (I am not a coder) and wondered what made you say "it's geared clearly to the very small server. " It gives you the overhead of reading the entire scoreboard for every request. You don't want to do that with high traffic, nor with anything but a very small scoreboard.[I haven't looked at the code for a moment but] why doesn't the parent do the scanning? Aside from an implementation detail or two, isn't that the only practical implementation?
I've actually hacked up mod_noloris to do exactly that. Was planning to test-drive then post, but since you bring the matter up, I'll attach it here and now. Commit to trunk? -- Nick Kew
/* Licensed to the Apache Software Foundation (ASF) under one or more * contributor license agreements. See the NOTICE file distributed with * this work for additional information regarding copyright ownership. * The ASF licenses this file to You under the Apache License, Version 2.0 * (the "License"); you may not use this file except in compliance with * the License. You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ /* The use of the scoreboard in this module is based on a similar * but simpler module, mod_antiloris by Kees Monshouwer, from * ftp://ftp.monshouwer.eu/pub/linux/mod_antiloris/ * Note the FIXME that affects both modules. * * The major difference is that mod_antiloris checks the scoreboard * on every request. This implies a per-request overhead that grows * with the scoreboard, and gets very expensive on a big server. * On the other hand, this module (mod_noloris) may be slower to * react to a DoS attack, and in the case of a very small server * it might be too late. * * Author's untested instinct: mod_antiloris will suit servers with * Prefork MPM and low traffic. A server with a threaded MPM * (or possibly a big prefork server with lots of memory) should * raise MaxClients and use mod_noloris. */ #include "httpd.h" #include "http_config.h" #include "http_connection.h" #include "http_log.h" #include "mpm_common.h" #include "ap_mpm.h" #include "apr_hash.h" module AP_MODULE_DECLARE_DATA noloris_module; static unsigned int default_max_connections; static apr_hash_t *trusted; static apr_interval_time_t recheck_time; static apr_shm_t *shm; static apr_size_t shm_size; static int server_limit; static int thread_limit; static int noloris_conn(conn_rec *conn) { /*** FIXME * This is evil: we're assuming info that's private to the scoreboard * We need to do that because there's no API to update the scoreboard * on a connection, only with a request (or NULL to say not processing * any request). We need a version of ap_update_child_status that * accepts a conn_rec. */ struct { int child_num; int thread_num; } *sbh = conn->sbh; char *shm_rec; worker_score *ws; if (shm == NULL) { return DECLINED; /* we're disabled */ } /* check the IP is not banned */ shm_rec = apr_shm_baseaddr_get(shm); if (strstr(shm_rec, conn->remote_ip)) { ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, conn, "Dropping connection from banned IP %s", conn->remote_ip); return OK; } /* store this client IP for the monitor to pick up */ /* under traditional scoreboard, none of this happens until * there's a request_rec. This is where we use the illegally- * obtained private info from the scoreboard. */ ws = &ap_scoreboard_image->servers[sbh->child_num][sbh->thread_num]; strcpy(ws->client, conn->remote_ip); return DECLINED; } static int noloris_monitor(apr_pool_t *pool) { int i, j; int *totals; int *n; int index = 0; apr_hash_t *connections = NULL; apr_hash_index_t *hi; char ip[18]; static apr_time_t last_check = 0; apr_time_t time_now; char *shm_rec; worker_score *ws; /* do nothing if disabled */ if (shm == NULL) { return 0; } /* skip check if it's not due yet */ time_now = apr_time_now(); if (time_now - last_check < recheck_time) { return 0; } last_check = time_now; /* alloc lots of stuff at start, so we don't leak memory per-call */ if (connections == NULL) { connections = apr_hash_make(pool); totals = apr_palloc(pool, server_limit*thread_limit); } /* Get a per-client count of connections in READ state */ for (i = 0; i < server_limit; ++i) { for (j = 0; j < thread_limit; ++j) { ws = ap_get_scoreboard_worker(i, j); switch (ws->status) { case SERVER_BUSY_READ: n = apr_hash_get(connections, ws->client, APR_HASH_KEY_STRING); if (n == NULL) { n = totals + index++ ; *n = 0; } ++*n; apr_hash_set(connections, ws->client, APR_HASH_KEY_STRING, n); break; default: break; } } } /* reset shm before writing to it. * We're only dealing with approx. counts, so we ignore the race condition * with our prospective readers */ shm_rec = apr_shm_baseaddr_get(shm); memset(shm, NULL, shm_size); /* Now check the hash for clients with too many connections in READ state */ for (hi = apr_hash_first(NULL, connections); hi; hi = apr_hash_next(hi)) { apr_hash_this(hi, (void*) &ip, NULL, (void**)&n); if (*n >= default_max_connections) { /* if this isn't a trusted proxy, we mark it as bad */ if (!apr_hash_get(trusted, ip, APR_HASH_KEY_STRING)) { ap_log_error(APLOG_MARK, APLOG_WARNING, 0, 0, "noloris: banning %s with %d connections in READ state", ip, *n); strcpy(shm_rec++, " "); /* space == separator */ strcpy(shm_rec, ip); shm_rec += strlen(ip); } } } apr_hash_clear(connections); return 0; } static int noloris_post(apr_pool_t *pconf, apr_pool_t *ptmp, apr_pool_t *plog, server_rec *s) { apr_status_t rv; int max_bans = thread_limit * server_limit / default_max_connections; shm_size = 18 * max_bans; rv = apr_shm_create(&shm, shm_size, NULL, pconf); if (rv != APR_SUCCESS) { ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s, "Failed to create shm segment; mod_noloris disabled"); apr_hash_clear(trusted); shm = NULL; } return 0; } static int noloris_pre(apr_pool_t *pconf, apr_pool_t *ptmp, apr_pool_t *plog) { ap_mpm_query(AP_MPMQ_HARD_LIMIT_THREADS, &thread_limit); ap_mpm_query(AP_MPMQ_HARD_LIMIT_DAEMONS, &server_limit); /* set up default config stuff here */ trusted = apr_hash_make(pconf); default_max_connections = 50; recheck_time = apr_time_from_sec(10); return 0; } static void noloris_hooks(apr_pool_t *p) { ap_hook_process_connection(noloris_conn, NULL, NULL, APR_HOOK_FIRST); ap_hook_pre_config(noloris_pre, NULL, NULL, APR_HOOK_MIDDLE); ap_hook_post_config(noloris_post, NULL, NULL, APR_HOOK_MIDDLE); ap_hook_monitor(noloris_monitor, NULL, NULL, APR_HOOK_MIDDLE); } static const char *noloris_trusted(cmd_parms *cmd, void *cfg, const char *val) { const char* err = ap_check_cmd_context(cmd, GLOBAL_ONLY); if (!err) { apr_hash_set(trusted, val, APR_HASH_KEY_STRING, &noloris_module); } return err; } static const char *noloris_recheck(cmd_parms *cmd, void *cfg, const char *val) { const char* err = ap_check_cmd_context(cmd, GLOBAL_ONLY); if (!err) { recheck_time = apr_time_from_sec(atoi(val)); } return err; } static const char *noloris_max_conn(cmd_parms *cmd, void *cfg, const char *val) { const char* err = ap_check_cmd_context(cmd, GLOBAL_ONLY); if (!err) { default_max_connections = atoi(val); } return err; } static const command_rec noloris_cmds[] = { AP_INIT_ITERATE("TrustedProxy", noloris_trusted, NULL, RSRC_CONF, "IP addresses from which to allow unlimited connections"), AP_INIT_TAKE1("ClientRecheckTime", noloris_recheck, NULL, RSRC_CONF, "Time interval for rechecking client connection tables"), AP_INIT_TAKE1("MaxClientConnections", noloris_max_conn, NULL, RSRC_CONF, "Max connections in READ state to permit from an untrusted client"), {NULL} }; module AP_MODULE_DECLARE_DATA noloris_module = { STANDARD20_MODULE_STUFF, NULL, NULL, NULL, NULL, noloris_cmds, noloris_hooks };
