mod_noloris.c revision 237b1c198de800d82b737a77ca5e48fe1ff7bc94
0b3b020a178cf3b957fed627de13c895773995ecLennart Poettering/* Licensed to the Apache Software Foundation (ASF) under one or more
0b3b020a178cf3b957fed627de13c895773995ecLennart Poettering * contributor license agreements. See the NOTICE file distributed with
12b42c76672a66c2d4ea7212c14f8f1b5a62b78dTom Gundersen * this work for additional information regarding copyright ownership.
0b3b020a178cf3b957fed627de13c895773995ecLennart Poettering * The ASF licenses this file to You under the Apache License, Version 2.0
0b3b020a178cf3b957fed627de13c895773995ecLennart Poettering * (the "License"); you may not use this file except in compliance with
0b3b020a178cf3b957fed627de13c895773995ecLennart Poettering * the License. You may obtain a copy of the License at
0b3b020a178cf3b957fed627de13c895773995ecLennart Poettering * http://www.apache.org/licenses/LICENSE-2.0
0b3b020a178cf3b957fed627de13c895773995ecLennart Poettering * Unless required by applicable law or agreed to in writing, software
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering * distributed under the License is distributed on an "AS IS" BASIS,
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
0b3b020a178cf3b957fed627de13c895773995ecLennart Poettering * See the License for the specific language governing permissions and
0b3b020a178cf3b957fed627de13c895773995ecLennart Poettering * limitations under the License.
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering/* The use of the scoreboard in this module is based on a similar
0b3b020a178cf3b957fed627de13c895773995ecLennart Poettering * but simpler module, mod_antiloris by Kees Monshouwer, from
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering * ftp://ftp.monshouwer.eu/pub/linux/mod_antiloris/
0b3b020a178cf3b957fed627de13c895773995ecLennart Poettering * Note the FIXME that affects both modules.
0b3b020a178cf3b957fed627de13c895773995ecLennart Poettering * The major difference is that mod_antiloris checks the scoreboard
56ba3c78ae35065064c4289a0c8e22a81256af20Zbigniew Jędrzejewski-Szmek * on every request. This implies a per-request overhead that grows
0b3b020a178cf3b957fed627de13c895773995ecLennart Poettering * with the scoreboard, and gets very expensive on a big server.
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek * On the other hand, this module (mod_noloris) may be slower to
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek * react to a DoS attack, and in the case of a very small server
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek * it might be too late.
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek * Author's untested instinct: mod_antiloris will suit servers with
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek * Prefork MPM and low traffic. A server with a threaded MPM
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek * (or possibly a big prefork server with lots of memory) should
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek * raise MaxClients and use mod_noloris.
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekmodule AP_MODULE_DECLARE_DATA noloris_module;
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekmodule AP_MODULE_DECLARE_DATA core_module;
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekstatic unsigned int default_max_connections;
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekstatic apr_interval_time_t recheck_time;
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekstatic int noloris_conn(conn_rec *conn)
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek struct { int child_num; int thread_num; } *sbh = conn->sbh;
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek return DECLINED; /* we're disabled */
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek /* check the IP is not banned */
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek shm_rec = apr_shm_baseaddr_get(shm);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek if (!strcmp(shm_rec, conn->remote_ip)) {
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek apr_socket_t *csd = ap_get_module_config(conn->conn_config, &core_module);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, conn,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek "Dropping connection from banned IP %s",
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek /* store this client IP for the monitor to pick up */
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ap_update_child_status_from_conn(conn->sbh, SERVER_READY, conn);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekstatic int noloris_monitor(apr_pool_t *pool, server_rec *s)
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek static apr_hash_t *connections = NULL;
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek static apr_time_t last_check = 0;
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek /* do nothing if disabled */
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek /* skip check if it's not due yet */
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek if (time_now - last_check < recheck_time) {
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek /* alloc lots of stuff at start, so we don't leak memory per-call */
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek connections = apr_hash_make(pool);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek totals = apr_palloc(pool, server_limit*thread_limit);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ip = apr_palloc(pool, ADDR_MAX_SIZE);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek /* Get a per-client count of connections in READ state */
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek for (i = 0; i < server_limit; ++i) {
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek for (j = 0; j < thread_limit; ++j) {
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ws = ap_get_scoreboard_worker_from_indexes(i, j);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek if (ws->status == SERVER_BUSY_READ) {
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek n = apr_hash_get(connections, ws->client, APR_HASH_KEY_STRING);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek apr_hash_set(connections, ws->client, APR_HASH_KEY_STRING, n);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek /* reset shm before writing to it.
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek * We're only dealing with approx. counts, so we ignore the race condition
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek * with our prospective readers
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek shm_rec = apr_shm_baseaddr_get(shm);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek /* Now check the hash for clients with too many connections in READ state */
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek for (hi = apr_hash_first(NULL, connections); hi; hi = apr_hash_next(hi)) {
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek apr_hash_this(hi, (const void**) &ip, NULL, (void**)&n);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek if (*n >= default_max_connections) {
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek /* if this isn't a trusted proxy, we mark it as bad */
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek if (!apr_hash_get(trusted, ip, APR_HASH_KEY_STRING)) {
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek "noloris: banning %s with %d connections in READ state",
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekstatic int noloris_post(apr_pool_t *pconf, apr_pool_t *ptmp, apr_pool_t *plog,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek int max_bans = thread_limit * server_limit / default_max_connections;
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek shm_size = ADDR_MAX_SIZE * max_bans;
667c24a6a86a5a26a906b7477ae81dcf4c73e64eLennart Poettering rv = apr_shm_create(&shm, shm_size, NULL, pconf);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s,
667c24a6a86a5a26a906b7477ae81dcf4c73e64eLennart Poettering "Failed to create shm segment; mod_noloris disabled");
667c24a6a86a5a26a906b7477ae81dcf4c73e64eLennart Poetteringstatic int noloris_pre(apr_pool_t *pconf, apr_pool_t *ptmp, apr_pool_t *plog)
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ap_mpm_query(AP_MPMQ_HARD_LIMIT_THREADS, &thread_limit);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ap_mpm_query(AP_MPMQ_HARD_LIMIT_DAEMONS, &server_limit);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek /* set up default config stuff here */
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek recheck_time = apr_time_from_sec(10);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekstatic void noloris_hooks(apr_pool_t *p)
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ap_hook_process_connection(noloris_conn, NULL, NULL, APR_HOOK_FIRST);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ap_hook_pre_config(noloris_pre, NULL, NULL, APR_HOOK_MIDDLE);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ap_hook_post_config(noloris_post, NULL, NULL, APR_HOOK_MIDDLE);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ap_hook_monitor(noloris_monitor, NULL, NULL, APR_HOOK_MIDDLE);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekstatic const char *noloris_trusted(cmd_parms *cmd, void *cfg, const char *val)
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek const char* err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek apr_hash_set(trusted, val, APR_HASH_KEY_STRING, &noloris_module);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekstatic const char *noloris_recheck(cmd_parms *cmd, void *cfg, const char *val)
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek const char* err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek recheck_time = apr_time_from_sec(atoi(val));
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekstatic const char *noloris_max_conn(cmd_parms *cmd, void *cfg, const char *val)
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek const char* err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek default_max_connections = atoi(val);
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekstatic const command_rec noloris_cmds[] = {
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek AP_INIT_ITERATE("TrustedProxy", noloris_trusted, NULL, RSRC_CONF,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek "IP addresses from which to allow unlimited connections"),
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek AP_INIT_TAKE1("ClientRecheckTime", noloris_recheck, NULL, RSRC_CONF,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek "Time interval for rechecking client connection tables"),
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek AP_INIT_TAKE1("MaxClientConnections", noloris_max_conn, NULL, RSRC_CONF,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek "Max connections in READ state to permit from an untrusted client"),
NULL,