/* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/* The use of the scoreboard in this module is based on a similar
* but simpler module, mod_antiloris by Kees Monshouwer, from
* Note the FIXME that affects both modules.
*
* The major difference is that mod_antiloris checks the scoreboard
* on every request. This implies a per-request overhead that grows
* with the scoreboard, and gets very expensive on a big server.
* On the other hand, this module (mod_noloris) may be slower to
* react to a DoS attack, and in the case of a very small server
* it might be too late.
*
* Author's untested instinct: mod_antiloris will suit servers with
* Prefork MPM and low traffic. A server with a threaded MPM
* (or possibly a big prefork server with lots of memory) should
* raise MaxClients and use mod_noloris.
*/
#include "httpd.h"
#include "http_config.h"
#include "http_core.h"
#include "http_connection.h"
#include "http_log.h"
#include "mpm_common.h"
#include "ap_mpm.h"
#include "apr_hash.h"
#include "scoreboard.h"
static unsigned int default_max_connections;
static int server_limit;
static int thread_limit;
{
char *shm_rec;
return DECLINED; /* we're disabled */
}
/* check the IP is not banned */
while (shm_rec[0] != '\0') {
"Dropping connection from banned IP %s",
return DONE;
}
shm_rec += ADDR_MAX_SIZE;
}
/* store this client IP for the monitor to pick up */
return DECLINED;
}
{
static int *totals;
int i, j;
int *n;
int index = 0;
char *ip;
char *shm_rec;
/* do nothing if disabled */
return 0;
}
/* skip check if it's not due yet */
time_now = apr_time_now();
return 0;
}
/* alloc lots of stuff at start, so we don't leak memory per-call */
if (connections == NULL) {
}
/* Get a per-client count of connections in READ state */
for (i = 0; i < server_limit; ++i) {
for (j = 0; j < thread_limit; ++j) {
ws = ap_get_scoreboard_worker_from_indexes(i, j);
if (n == NULL) {
*n = 0;
}
++*n;
}
}
}
/* reset shm before writing to it.
* We're only dealing with approx. counts, so we ignore the race condition
* with our prospective readers
*/
/* Now check the hash for clients with too many connections in READ state */
if (*n >= default_max_connections) {
/* if this isn't a trusted proxy, we mark it as bad */
"noloris: banning %s with %d connections in READ state",
ip, *n);
shm_rec += ADDR_MAX_SIZE;
}
}
}
return 0;
}
server_rec *s)
{
if (rv != APR_SUCCESS) {
"Failed to create shm segment; mod_noloris disabled");
}
return 0;
}
{
/* set up default config stuff here */
default_max_connections = 50;
return 0;
}
{
}
{
if (!err) {
}
return err;
}
{
if (!err) {
}
return err;
}
{
if (!err) {
}
return err;
}
"IP addresses from which to allow unlimited connections"),
"Time interval for rechecking client connection tables"),
"Max connections in READ state to permit from an untrusted client"),
{NULL}
};
NULL,
NULL,
NULL,
NULL,
};