mod_noloris.c revision c41be3600a58bd39a76d1215abcdbbd8e9b1c356
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz/* Licensed to the Apache Software Foundation (ASF) under one or more
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz * contributor license agreements. See the NOTICE file distributed with
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz * this work for additional information regarding copyright ownership.
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz * The ASF licenses this file to You under the Apache License, Version 2.0
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz * (the "License"); you may not use this file except in compliance with
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz * the License. You may obtain a copy of the License at
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd *
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd * http://www.apache.org/licenses/LICENSE-2.0
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd *
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd * Unless required by applicable law or agreed to in writing, software
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd * distributed under the License is distributed on an "AS IS" BASIS,
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd * See the License for the specific language governing permissions and
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd * limitations under the License.
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd */
52fff662005b1866a3ff09bb6c902800c5cc6dedjerenkrantz
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd/* The use of the scoreboard in this module is based on a similar
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd * but simpler module, mod_antiloris by Kees Monshouwer, from
4b5981e276e93df97c34e4da05ca5cf8bbd937dand * ftp://ftp.monshouwer.eu/pub/linux/mod_antiloris/
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd * Note the FIXME that affects both modules.
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd *
3b3b7fc78d1f5bfc2769903375050048ff41ff26nd * The major difference is that mod_antiloris checks the scoreboard
0066eddda7203f6345b56f77d146a759298dc635gryzor * on every request. This implies a per-request overhead that grows
f086b4b402fa9a2fefc7dda85de2a3cc1cd0a654rjung * with the scoreboard, and gets very expensive on a big server.
3b3b7fc78d1f5bfc2769903375050048ff41ff26nd * On the other hand, this module (mod_noloris) may be slower to
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd * react to a DoS attack, and in the case of a very small server
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd * it might be too late.
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd *
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd * Author's untested instinct: mod_antiloris will suit servers with
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd * Prefork MPM and low traffic. A server with a threaded MPM
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin * (or possibly a big prefork server with lots of memory) should
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd * raise MaxClients and use mod_noloris.
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd */
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin
3267af3f6fbf9743e64a9f019c745317f18cd9f7poirier#include "httpd.h"
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf#include "http_config.h"
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin#include "http_core.h"
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf#include "http_connection.h"
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin#include "http_log.h"
cb3a1082aec4b3b4f4ed238c93c3cc54933a7f0end#include "mpm_common.h"
cb3a1082aec4b3b4f4ed238c93c3cc54933a7f0end#include "ap_mpm.h"
f8b7daeb0e3f0ac4544fcc665de10c6b69a1ce0dsf#include "apr_hash.h"
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz#include "scoreboard.h"
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantzmodule AP_MODULE_DECLARE_DATA noloris_module;
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz#define ADDR_MAX_SIZE 48
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantzstatic unsigned int default_max_connections;
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4ndstatic apr_hash_t *trusted;
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4ndstatic apr_interval_time_t recheck_time;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinstatic apr_shm_t *shm;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinstatic apr_size_t shm_size;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinstatic int server_limit;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinstatic int thread_limit;
35ff2d06df95b9593ee312dfff883c76f3b97798noodl
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinstatic int noloris_conn(conn_rec *conn)
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd{
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin struct { int child_num; int thread_num; } *sbh = conn->sbh;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin char *shm_rec;
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd if (shm == NULL) {
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd return DECLINED; /* we're disabled */
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin }
35ff2d06df95b9593ee312dfff883c76f3b97798noodl
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin /* check the IP is not banned */
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf shm_rec = apr_shm_baseaddr_get(shm);
3267af3f6fbf9743e64a9f019c745317f18cd9f7poirier while (shm_rec[0] != '\0') {
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf if (!strcmp(shm_rec, conn->client_ip)) {
f8b7daeb0e3f0ac4544fcc665de10c6b69a1ce0dsf apr_socket_t *csd = ap_get_conn_socket(conn);
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, conn, APLOGNO(02059)
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin "Dropping connection from banned IP %s",
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin conn->client_ip);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin apr_socket_close(csd);
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz
f8b7daeb0e3f0ac4544fcc665de10c6b69a1ce0dsf return DONE;
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz }
a7a43799fed7fcdeaa70584dbd3ecd130b25deb3noodl shm_rec += ADDR_MAX_SIZE;
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz }
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf /* store this client IP for the monitor to pick up */
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin ap_update_child_status_from_conn(conn->sbh, SERVER_READY, conn);
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin return DECLINED;
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf}
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinstatic int noloris_monitor(apr_pool_t *pool, server_rec *s)
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin{
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin static apr_hash_t *connections = NULL;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin static apr_time_t last_check = 0;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin static int *totals;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf int i, j;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin int *n;
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf int index = 0;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin apr_hash_index_t *hi;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin char *ip;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin apr_time_t time_now;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin char *shm_rec;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin worker_score *ws;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf /* do nothing if disabled */
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin if (shm == NULL) {
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf return 0;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin }
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin /* skip check if it's not due yet */
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin time_now = apr_time_now();
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin if (time_now - last_check < recheck_time) {
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf return 0;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin }
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf last_check = time_now;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin /* alloc lots of stuff at start, so we don't leak memory per-call */
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin if (connections == NULL) {
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin connections = apr_hash_make(pool);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin totals = apr_palloc(pool, server_limit*thread_limit);
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf ip = apr_palloc(pool, ADDR_MAX_SIZE);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin }
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf /* Get a per-client count of connections in READ state */
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin for (i = 0; i < server_limit; ++i) {
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin for (j = 0; j < thread_limit; ++j) {
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf ws = ap_get_scoreboard_worker_from_indexes(i, j);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin if (ws->status == SERVER_BUSY_READ) {
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin n = apr_hash_get(connections, ws->client, APR_HASH_KEY_STRING);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin if (n == NULL) {
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin n = totals + index++ ;
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz *n = 0;
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz }
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz ++*n;
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz apr_hash_set(connections, ws->client, APR_HASH_KEY_STRING, n);
a7a43799fed7fcdeaa70584dbd3ecd130b25deb3noodl }
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz }
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin }
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf /* reset shm before writing to it.
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin * We're only dealing with approx. counts, so we ignore the race condition
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz * with our prospective readers
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin */
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf shm_rec = apr_shm_baseaddr_get(shm);
aa0b2780958e9b1467c9d0153a05738e399811a5nd memset(shm_rec, 0, shm_size);
9a367ec3d570bcbaf8923dad66cb3b1532963964trawick
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin /* Now check the hash for clients with too many connections in READ state */
aa0b2780958e9b1467c9d0153a05738e399811a5nd for (hi = apr_hash_first(NULL, connections); hi; hi = apr_hash_next(hi)) {
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf apr_hash_this(hi, (const void**) &ip, NULL, (void**)&n);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin if (*n >= default_max_connections) {
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin /* if this isn't a trusted proxy, we mark it as bad */
9a367ec3d570bcbaf8923dad66cb3b1532963964trawick if (!apr_hash_get(trusted, ip, APR_HASH_KEY_STRING)) {
9a367ec3d570bcbaf8923dad66cb3b1532963964trawick ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(02060)
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin "noloris: banning %s with %d connections in READ state",
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin ip, *n);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin strcpy(shm_rec, ip);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin shm_rec += ADDR_MAX_SIZE;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin }
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin }
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin }
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz apr_hash_clear(connections);
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz return 0;
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz}
1b390add6886fb1c0acdea82be0ef0920f1158casfstatic int noloris_post(apr_pool_t *pconf, apr_pool_t *ptmp, apr_pool_t *plog,
1b390add6886fb1c0acdea82be0ef0920f1158casf server_rec *s)
1b390add6886fb1c0acdea82be0ef0920f1158casf{
1b390add6886fb1c0acdea82be0ef0920f1158casf apr_status_t rv;
1b390add6886fb1c0acdea82be0ef0920f1158casf int max_bans = thread_limit * server_limit / default_max_connections;
1b390add6886fb1c0acdea82be0ef0920f1158casf shm_size = ADDR_MAX_SIZE * max_bans;
1b390add6886fb1c0acdea82be0ef0920f1158casf
1b390add6886fb1c0acdea82be0ef0920f1158casf rv = apr_shm_create(&shm, shm_size, NULL, pconf);
1b390add6886fb1c0acdea82be0ef0920f1158casf if (rv != APR_SUCCESS) {
1b390add6886fb1c0acdea82be0ef0920f1158casf ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s, APLOGNO(02061)
1b390add6886fb1c0acdea82be0ef0920f1158casf "Failed to create shm segment; mod_noloris disabled");
1b390add6886fb1c0acdea82be0ef0920f1158casf apr_hash_clear(trusted);
1b390add6886fb1c0acdea82be0ef0920f1158casf shm = NULL;
1b390add6886fb1c0acdea82be0ef0920f1158casf }
1b390add6886fb1c0acdea82be0ef0920f1158casf return 0;
1b390add6886fb1c0acdea82be0ef0920f1158casf}
1b390add6886fb1c0acdea82be0ef0920f1158casfstatic int noloris_pre(apr_pool_t *pconf, apr_pool_t *ptmp, apr_pool_t *plog)
1b390add6886fb1c0acdea82be0ef0920f1158casf{
1b390add6886fb1c0acdea82be0ef0920f1158casf ap_mpm_query(AP_MPMQ_HARD_LIMIT_THREADS, &thread_limit);
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd ap_mpm_query(AP_MPMQ_HARD_LIMIT_DAEMONS, &server_limit);
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd
3b3b7fc78d1f5bfc2769903375050048ff41ff26nd /* set up default config stuff here */
0066eddda7203f6345b56f77d146a759298dc635gryzor trusted = apr_hash_make(pconf);
f086b4b402fa9a2fefc7dda85de2a3cc1cd0a654rjung default_max_connections = 50;
3b3b7fc78d1f5bfc2769903375050048ff41ff26nd recheck_time = apr_time_from_sec(10);
9c1260efa52c82c2a58e5b5f20cd6902563d95f5rbowen return 0;
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd}
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4ndstatic void noloris_hooks(apr_pool_t *p)
{
ap_hook_process_connection(noloris_conn, NULL, NULL, APR_HOOK_FIRST);
ap_hook_pre_config(noloris_pre, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_post_config(noloris_post, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_monitor(noloris_monitor, NULL, NULL, APR_HOOK_MIDDLE);
}
static const char *noloris_trusted(cmd_parms *cmd, void *cfg, const char *val)
{
const char* err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
if (!err) {
apr_hash_set(trusted, val, APR_HASH_KEY_STRING, &noloris_module);
}
return err;
}
static const char *noloris_recheck(cmd_parms *cmd, void *cfg, const char *val)
{
const char* err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
if (!err) {
recheck_time = apr_time_from_sec(atoi(val));
}
return err;
}
static const char *noloris_max_conn(cmd_parms *cmd, void *cfg, const char *val)
{
const char* err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
if (!err) {
default_max_connections = atoi(val);
}
return err;
}
static const command_rec noloris_cmds[] = {
AP_INIT_ITERATE("TrustedProxy", noloris_trusted, NULL, RSRC_CONF,
"IP addresses from which to allow unlimited connections"),
AP_INIT_TAKE1("ClientRecheckTime", noloris_recheck, NULL, RSRC_CONF,
"Time interval for rechecking client connection tables"),
AP_INIT_TAKE1("MaxClientConnections", noloris_max_conn, NULL, RSRC_CONF,
"Max connections in READ state to permit from an untrusted client"),
{NULL}
};
AP_DECLARE_MODULE(noloris) = {
STANDARD20_MODULE_STUFF,
NULL,
NULL,
NULL,
NULL,
noloris_cmds,
noloris_hooks
};