Keep Server Online
If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.
or
A donation makes a contribution towards the costs, the time and effort that's going in this site and building.
Thank You! Steffen
Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
| |
|
 Topic: mod_antiloris.c improved (v0.5.2) for Apache 2.2 and 2.4 |
Page Previous 1, 2 |
| Author |
|
glsmith
Moderator
Joined: 16 Oct 2007
Posts: 2268
Location: Sun Diego, USA
|
 Posted: Thu 08 Mar '12 0:43 Post subject: |
 |
|
This is why I do not use the module and argued about all the targets. IMO, if a connection is marked "Closing," it's going to be closed quickly. I do not see how anyone could hang a connection that's in closing stage or graceful, but I'm no l33t h4xor.
To be honest, I see no purpose for anything beyond
case SERVER_BUSY_READ:
case SERVER_BUSY_WRITE:
case SERVER_BUSY_KEEPALIVE:
If you have short enough keepalives even the latter is of less use in my opinion but, that is just my opinion.
I use 0.4 which is specifically for SlowLoris, I have a page of almost 600 thumnails on an XP, XP has a 20 connection limitation. I have no problem serving this page with MAX_PER_IP 10, I also use mod_reqtimeout to handle the SlowHttp attack.
As with any module, I suppose there's a possibility that another module will not play nice in the sandbox. I do not have mod_cloudflare, so do not know. |
|
| Back to top |
|
maskego
Joined: 16 Apr 2010
Posts: 238
|
| Posted: Fri 16 Mar '12 3:21 Post subject: |
|
|
How do I set the mod_reqtimeout?And,what is the suggestion of mod_reqtimeout setting ? |
|
| Back to top |
|
maskego
Joined: 16 Apr 2010
Posts: 238
|
| Posted: Mon 19 Mar '12 5:10 Post subject: |
|
|
gl:
mod_antiloris seems can't to stop slowloris attack.The web service stops during slowloris attacking.(I make a test)
Is there any good idea to stop slowloris ?  |
|
| Back to top |
|
glsmith
Moderator
Joined: 16 Oct 2007
Posts: 2268
Location: Sun Diego, USA
|
| Posted: Mon 19 Mar '12 6:23 Post subject: |
|
|
mod_reqtimeout should,
You asked about settings for it .. but you are going to just have to experiment on that one. It will not be the same for everyone. Try it's defaults (just load the module) .. if that it not enough .. lower the limits
by the way, is this mod_antiloris 0.5.1, or 0.4.1, or both? |
|
| Back to top |
|
maskego
Joined: 16 Apr 2010
Posts: 238
|
| Posted: Mon 19 Mar '12 7:17 Post subject: |
|
|
gl:
I install both mod_reqtimeout and mod_antiloris 0.4 after google it.It seems doesn't take effects on my site.I use slowloris to test it.Web service stops during at attacking time.Maybe it's apache's destiny under slowloris attacking?Mod_antiloris just can mitigate slowloris attack not to stop it.
And,where can I get mod_antiloris 0.5.1, or 0.4.1 for apache 2.2.x?
Would you please to compile mod_antiloris 0.5.1, or 0.4.1 for apache 2.2.x? |
|
| Back to top |
|
glsmith
Moderator
Joined: 16 Oct 2007
Posts: 2268
Location: Sun Diego, USA
|
| Posted: Mon 19 Mar '12 9:03 Post subject: |
|
|
the only difference between 0.4 and 0.4.1 is that 0.4.1 can be built with Apache 2.4 as well as 2.2, nothing more.
Same with the difference with 0.5 & 0.5.1. 0.5 however targets other Slowloris type attacks.
If it brings down the Apache service then something else is wrong. What do you mean by brings down? The service actually stops?
Slowloris just hogs up all open connections, that is how it works. Once all the connections are in use, no one else can get into the server. Once the attack has stop, Apache should come back after a minute or two.
0.4 for Apache 2.2 is at the Apache Haus
0.5 for Apache 2.2 you can get from NewEraCracker on the first page of this thread. There is no reason to build 0.4.1 or 0.5.1 for Apache 2.2, after the compiler acts on the ifdef/else/endif, it just the same module. |
|
| Back to top |
|
maskego
Joined: 16 Apr 2010
Posts: 238
|
| Posted: Mon 19 Mar '12 9:21 Post subject: |
|
|
When slowloris start to attack,I can't connect to the site anymore.That's why I don't know what stops of mod_antiloris.I am sure the mod_antiloris is installed correctly.After the slowloris stops,I can connect to site again.
What is the function of mod_antiloris?
To stop slowloris or mitigate slowloris?It's different.
Is there any good idea to stop slowloris actually?Or make other normal conection keep alive during attacking occurs. |
|
| Back to top |
|
maskego
Joined: 16 Apr 2010
Posts: 238
|
|
| Back to top |
|
glsmith
Moderator
Joined: 16 Oct 2007
Posts: 2268
Location: Sun Diego, USA
|
| Posted: Mon 19 Mar '12 21:59 Post subject: |
|
|
uses Unix timespec and I've not found a Windows equivalent yet ... so no.
Back to antiloris, are you using it's default settings, because I have people who claim it does work, tested with the slowloris script.
http://www.apachelounge.com/viewtopic.php?t=3137&start=0
However, if you are on WinXP, you only have like 20 connections, so you cannot configure mod_antiloris higher. Then of course you have to understand file sharing using up a couple, so it's not even 20 anymore.
If it's left at it's default of 5, it should work. |
|
| Back to top |
|
maskego
Joined: 16 Apr 2010
Posts: 238
|
| Posted: Tue 20 Mar '12 1:19 Post subject: |
|
|
I set the mod_antiloris number to 10.I install it at win2003server.
I get the logs below wehn I use slowloris to test it.
At the same time,I can't connect to this site via another computer.Does it mean,the mod_antiloris can't stop the slowloris attacking?I think if the mod_antiloris takes effects,I can visit this site from another computer.Actually,when there is a slowloris attacking,the site's web service is temporary stop to all its visitors.
It's so strange. 
My question is :Does mod_antiloris work fine?Does antiloris stop slowloris attack or mitigate it only?If I install mod_antiloris,when there is a slowloris attack,can I visit this site via another computer normally?
| Code: | logs
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
[warn] Rejected, too many connections in READ state from 192.168.15.33
|
|
|
| Back to top |
|
glsmith
Moderator
Joined: 16 Oct 2007
Posts: 2268
Location: Sun Diego, USA
|
| Posted: Tue 20 Mar '12 1:47 Post subject: |
|
|
That is mod_antiloris working right there.
Rejected = 403 error
Other users should be able to connect. That you cannot from another computer on your LAN may because Apache sees one IP regardless of which computer (cause of how your router handles loopback).
I have this problem, all computers inside the LAN show up as my router IP if I use my external domain name to get to the site. If I use my internal names, then it shows the LAN IPs of the different computer. Everyone outside shows up as their IP.
https://www.apachehaus.net <- Apache receives router ip
http://www.ah.lan <- Apache receives computer's proper LAN ip
Linksys, bleh! |
|
| Back to top |
|
maskego
Joined: 16 Apr 2010
Posts: 238
|
| Posted: Tue 20 Mar '12 4:07 Post subject: |
|
|
gl,
I figure it out.
It's routers issue to lead in my confusing.
I try to connect from another routers's computer to test,it's successful to site.
You always hit the target of issue.
best regards. |
|
| Back to top |
|
NewEraCracker
Joined: 23 Aug 2010
Posts: 36
|
| Posted: Sat 28 Apr '12 18:14 Post subject: |
|
|
Hello,
I've done some changes over mod_antiloris to fix some issues that have been reported.
Changes include removal of SERVER_CLOSING, SERVER_GRACEFUL state checking that were added in 0.5.0 and an improvement in socket handling with Apache 2.4 (taken the idea from mod_noloris).
diff --ignore-all-space -uN
| Code: |
--- mod_antiloris.c (0.4)
+++ mod_antiloris.c (0.5.2)
@@ -1,5 +1,5 @@
/*
- mod_antiloris 0.2
+ mod_antiloris 0.5.2
Copyright (C) 2008 Monshouwer Internet Diensten
Author: Kees Monshouwer
@@ -19,23 +19,37 @@
#include "httpd.h"
#include "http_config.h"
+#include "http_core.h"
#include "http_connection.h"
#include "http_log.h"
+#include "mpm_common.h"
#include "ap_mpm.h"
+#include "ap_release.h"
+#include "apr_hash.h"
#include "apr_strings.h"
#include "scoreboard.h"
#define MODULE_NAME "mod_antiloris"
-#define MODULE_VERSION "0.4"
+#define MODULE_VERSION "0.5.2"
+#define ANTILORIS_DEFAULT_MAX_CONN 20
+
+#ifdef APLOG_USE_MODULE
+APLOG_USE_MODULE(antiloris);
+#endif
+
+#if AP_MODULE_MAGIC_AT_LEAST(20111130,0)
+#define remote_ip client_ip
+#endif
+
+#ifndef INT_MAX
+#define INT_MAX 32767
+#endif
module AP_MODULE_DECLARE_DATA antiloris_module;
static int server_limit, thread_limit;
-#define antiloris_MAX_PER_IP 5
-
-typedef struct
-{
+typedef struct {
signed int limit;
} antiloris_config;
@@ -44,47 +58,41 @@
int thread_num;
} sb_handle;
-
/* Create per-server configuration structure */
static void *create_config(apr_pool_t *p, server_rec *s)
{
antiloris_config *conf = apr_pcalloc(p, sizeof (*conf));
- conf->limit = antiloris_MAX_PER_IP;
+ conf->limit = ANTILORIS_DEFAULT_MAX_CONN;
return conf;
}
-
/* Parse the IPReadLimit directive */
static const char *ipreadlimit_config_cmd(cmd_parms *parms, void *mconfig, const char *arg)
{
+ signed long int limit;
+
antiloris_config *conf = ap_get_module_config(parms->server->module_config, &antiloris_module);
const char *err = ap_check_cmd_context (parms, GLOBAL_ONLY);
- if (err != NULL) {
- return err;
- }
-
- signed long int limit = strtol(arg, (char **) NULL, 10);
+ if (!err) {
+ limit = strtol(arg, (char **) NULL, 10);
- /* No reasonable person would want more than 2^16. Better would be
- to use LONG_MAX but that causes portability problems on win32 */
- if ((limit > 65535) || (limit < 0)) {
+ if ((limit > INT_MAX) || (limit < 0))
return "Integer overflow or invalid number";
- }
conf->limit = limit;
- return NULL;
}
+ return err;
+}
/* Array describing structure of configuration directives */
static command_rec antiloris_cmds[] = {
- AP_INIT_TAKE1("IPReadLimit", ipreadlimit_config_cmd, NULL, RSRC_CONF, "Maximum simultaneous connections in READ state per IP address"),
+ AP_INIT_TAKE1("IPReadLimit", ipreadlimit_config_cmd, NULL, RSRC_CONF, "Maximum simultaneous connections per IP address"),
{NULL}
};
-
/* Set up startup-time initialization */
static int post_config(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s)
{
@@ -100,40 +108,56 @@
return OK;
}
- ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, MODULE_NAME " " MODULE_VERSION " started");
ap_mpm_query(AP_MPMQ_HARD_LIMIT_THREADS, &thread_limit);
ap_mpm_query(AP_MPMQ_HARD_LIMIT_DAEMONS, &server_limit);
+
+ ap_add_version_component(p, MODULE_NAME "/" MODULE_VERSION);
+ ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, MODULE_NAME " " MODULE_VERSION " started");
+
return OK;
}
-
static int pre_connection(conn_rec *c)
{
+ char *remote_ip;
+
antiloris_config *conf = ap_get_module_config (c->base_server->module_config, &antiloris_module);
sb_handle *sbh = c->sbh;
/* loop index variables */
- int i;
- int j;
+ int i, j;
/* running count of number of connections from this address */
int ip_count = 0;
+#if AP_MODULE_MAGIC_AT_LEAST(20071023,0)
+ /* get the socket descriptor */
+ apr_socket_t *csd = ap_get_conn_socket(c);
+#endif
+
/* scoreboard data structure */
worker_score *ws_record;
ws_record = &ap_scoreboard_image->servers[sbh->child_num][sbh->thread_num];
apr_cpystrn(ws_record->client, c->remote_ip, sizeof(ws_record->client));
- char *client_ip = ws_record->client;
+ remote_ip = ws_record->client;
/* Count up the number of connections we are handling right now from this IP address */
for (i = 0; i < server_limit; ++i) {
for (j = 0; j < thread_limit; ++j) {
+#if AP_MODULE_MAGIC_AT_LEAST(20071023,0)
+ ws_record = ap_get_scoreboard_worker_from_indexes(i, j);
+#else
ws_record = ap_get_scoreboard_worker(i, j);
+#endif
switch (ws_record->status) {
case SERVER_BUSY_READ:
- if (strcmp(client_ip, ws_record->client) == 0)
+ case SERVER_BUSY_WRITE:
+ case SERVER_BUSY_KEEPALIVE:
+ case SERVER_BUSY_DNS:
+ case SERVER_BUSY_LOG:
+ if (strcmp(remote_ip, ws_record->client) == 0)
ip_count++;
break;
default:
@@ -143,25 +167,22 @@
}
if (ip_count > conf->limit) {
- ap_log_error(APLOG_MARK, APLOG_WARNING, 0, NULL, "Rejected, too many connections in READ state from %s", c->remote_ip);
+ ap_log_error(APLOG_MARK, APLOG_WARNING, 0, NULL, "[client %s] Antiloris rejected, too many connections", c->remote_ip);
+#if AP_MODULE_MAGIC_AT_LEAST(20071023,0)
+ apr_socket_close(csd);
+ return DONE;
+#else
return OK;
- } else {
- return DECLINED;
- }
+#endif
}
-
-static void child_init (apr_pool_t *p, server_rec *s)
-{
- ap_add_version_component(p, MODULE_NAME "/" MODULE_VERSION);
+ return DECLINED;
}
-
static void register_hooks(apr_pool_t *p)
{
ap_hook_post_config(post_config, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_process_connection(pre_connection, NULL, NULL, APR_HOOK_FIRST);
- ap_hook_child_init(child_init, NULL, NULL, APR_HOOK_MIDDLE);
}
module AP_MODULE_DECLARE_DATA antiloris_module = {
|
Also it seems that ap_get_conn_socket was only added with module magic 20110605,2 anyway this doesn't cause any build issues since the version where it would fail would be 2.3 and that's only a developement version. Build works with 2.2 (tested with 2.2.22) and 2.4 (tested with 2.4.2). |
|
| Back to top |
|
NewEraCracker
Joined: 23 Aug 2010
Posts: 36
|
| Posted: Tue 09 Sep '14 18:25 Post subject: |
|
|
Today I have made some long overdue improvements to mod_antiloris code and bumped version to 0.6.0
Some parts of the code have been partially rewritten, added options to limit different states and added an option to specify local IP address(es) that will be ignored from limiting (this is based in a patch for mod_limitipconn patch found in the net).
The default settings are now 10 connections per type, which means each client can make up to 30 connections. If those limits are still not sufficient they can be increased in configuration.
| Code: | <IfModule antiloris_module>
IPReadLimit 20
IPWriteLimit 20
IPOtherLimit 20
</IfModule>
|
This example will allow up to 60 total connections per IP, 20 for each type.
To avoid false positives I'd also recommend tuning KeepAlive like this:
| Code: | #
# KeepAlive: Whether or not to allow persistent connections (more than
# one request per connection). Set to "Off" to deactivate.
#
KeepAlive On
#
# KeepAliveTimeout: Number of seconds to wait for the next request from the
# same client on the same connection.
#
KeepAliveTimeout 1
|
One second should be enough to keep things going over the same connection.
The local LocalIPs directive can be used like this:
| Code: | <IfModule antiloris_module>
LocalIPs ::1 127.0.0.1
</IfModule>
|
And here is the full code:
https://gist.github.com/NewEraCracker/e545f0dcf64ba816d49b
I will update my first post when I have some free time to compile it.
Regards,
NewEraCracker |
|
| Back to top |
|
glsmith
Moderator
Joined: 16 Oct 2007
Posts: 2268
Location: Sun Diego, USA
|
| Posted: Wed 10 Sep '14 3:19 Post subject: |
|
|
Since it's what we do
2.4.x vc11 x64 & x86
2.4.x vc14 x64 & x86
http://www.apachehaus.com/cgi-bin/download.plx
Edit: 2018-03-22 01:00 UTC
2.2.x is end-of-life
VC9 we do not do anymore
Last edited by glsmith on Thu 22 Mar '18 3:00; edited 1 time in total |
|
| Back to top |
|
DnvrSysEngr
Joined: 15 Apr 2012
Posts: 218
Location: Denver, CO USA
|
| Posted: Wed 10 Sep '14 5:23 Post subject: |
|
|
GL:
Anyone ever tell you, "you the man!!!"
Thank you. |
|
| Back to top |
|
|
|
|
|
|
