mod_evasivensapi.c

实现DOS攻击的源码

}


static const char *whitelist(const char *ip)
{
  char entry[128];
  snprintf(entry, sizeof(entry), "WHITELIST_%s", ip);
  ntt_insert(hit_list, entry, time(NULL));
  
  return NULL;
}


int is_whitelisted(const char *ip) {
  char hashkey[128];
  char octet[4][4];
  char *dip;
  char *oct;
  int i = 0;
  
  memset(octet, 0, 16);
  dip = strdup(ip);
  if (dip == NULL)
    return 0;
  
  oct = strtok(dip, ".");
  while(oct != NULL && i<4) {
    if (strlen(oct)<=3) 
      strcpy(octet[i], oct);
    i++;
    oct = strtok(NULL, ".");
  }
  free(dip);
  
  /* Exact Match */
  snprintf(hashkey, sizeof(hashkey), "WHITELIST_%s", ip); 
  if (ntt_find(hit_list, hashkey)!=NULL)
    return 1;
  
  /* IPv4 Wildcards */ 
  snprintf(hashkey, sizeof(hashkey), "WHITELIST_%s.*.*.*", octet[0]);
  if (ntt_find(hit_list, hashkey)!=NULL)
    return 1;

  snprintf(hashkey, sizeof(hashkey), "WHITELIST_%s.%s.*.*", octet[0], octet[1]);
  if (ntt_find(hit_list, hashkey)!=NULL)
    return 1;
  
  snprintf(hashkey, sizeof(hashkey), "WHITELIST_%s.%s.%s.*", octet[0], octet[1], octet[2]);
  if (ntt_find(hit_list, hashkey)!=NULL)
    return 1;
  
  /* No match */
  return 0;
}

static int destroy_hit_list(void *not_used) {
  ntt_destroy(hit_list);
  free(log_dir);
  free(email_notify);
  free(system_command);
  return 0;
}


/* BEGIN NTT (Named Timestamp Tree) Functions */

static unsigned long ntt_prime_list[ntt_num_primes] = 
{
  53ul,         97ul,         193ul,       389ul,       769ul,
  1543ul,       3079ul,       6151ul,      12289ul,     24593ul,
  49157ul,      98317ul,      196613ul,    393241ul,    786433ul,
  1572869ul,    3145739ul,    6291469ul,   12582917ul,  25165843ul,
  50331653ul,   100663319ul,  201326611ul, 402653189ul, 805306457ul,
  1610612741ul, 3221225473ul, 4294967291ul
};


/* Find the numeric position in the hash table based on key and modulus */

long ntt_hashcode(struct ntt *ntt, const char *key) {
  unsigned long val = 0;
  for (; *key; ++key) val = 5 * val + *key;
  return(val % ntt->size);
}

/* Creates a single node in the tree */

struct ntt_node *ntt_node_create(const char *key) {
  char *node_key;
  struct ntt_node* node;
  
  node = (struct ntt_node *) malloc(sizeof(struct ntt_node));
  if (node == NULL) {
    return NULL;
  }
  if ((node_key = strdup(key)) == NULL) {
    free(node);
    return NULL;
  }
  node->key = node_key;
  node->timestamp = time(NULL);
  node->next = NULL;
  return(node);
}

/* Tree initializer */

struct ntt *ntt_create(long size) {
  long i = 0;
  struct ntt *ntt = (struct ntt *) malloc(sizeof(struct ntt));
  
  if (ntt == NULL)
    return NULL;
  while (ntt_prime_list[i] < size) { i++; }
  ntt->size  = ntt_prime_list[i];
  ntt->items = 0;
  ntt->tbl   = (struct ntt_node **) calloc(ntt->size, sizeof(struct ntt_node *));
  if (ntt->tbl == NULL) {
        free(ntt);
        return NULL;
  }
  return(ntt);
}

/* Find an object in the tree */

struct ntt_node *ntt_find(struct ntt *ntt, const char *key) {
  long hash_code;
  struct ntt_node *node;
  
  if (ntt == NULL) return NULL;
  
  hash_code = ntt_hashcode(ntt, key);
  node = ntt->tbl[hash_code];
  
  while (node) {
    if (!strcmp(key, node->key)) {
      return(node);
    }
    node = node->next;
  }
  return((struct ntt_node *)NULL);
}

/* Insert a node into the tree */

struct ntt_node *ntt_insert(struct ntt *ntt, const char *key, time_t timestamp) {
  long hash_code;
  struct ntt_node *parent;
  struct ntt_node *node;
  struct ntt_node *new_node = NULL;
  
  if (ntt == NULL) return NULL;
  
  hash_code = ntt_hashcode(ntt, key);
  parent	= NULL;
  node	= ntt->tbl[hash_code];
  
  crit_enter(mod_dosevasive_crit); /*Lock*/

  while (node != NULL) {
    if (strcmp(key, node->key) == 0) { 
      new_node = node;
      node = NULL;
    }
    
    if (new_node == NULL) {
      parent = node;
      node = node->next;
    }
  }
  
  if (new_node != NULL) {
    new_node->timestamp = timestamp;
    new_node->count = 0;
    crit_exit(mod_dosevasive_crit); /*Unlock*/
    return new_node; 
  }
  
  /* Create a new node */
  new_node = ntt_node_create(key);
  new_node->timestamp = timestamp;
  new_node->timestamp = 0;
  
  ntt->items++;
  
  /* Insert */
  if (parent) {  /* Existing parent */
    parent->next = new_node;
    crit_exit(mod_dosevasive_crit); /*Unlock*/
    return new_node;  /* Return the locked node */
  }
  
  /* No existing parent; add directly to hash table */
  ntt->tbl[hash_code] = new_node;
  crit_exit(mod_dosevasive_crit); /*Unlock*/
  return new_node;
}

/* Tree destructor */

int ntt_destroy(struct ntt *ntt) {
  struct ntt_node *node, *next;
  struct ntt_c c;
  
  if (ntt == NULL) return -1;
  
  node = c_ntt_first(ntt, &c);
  while(node != NULL) {
    next = c_ntt_next(ntt, &c);
    ntt_delete(ntt, node->key);
    node = next;
  }
  
  free(ntt->tbl);
  free(ntt);
  ntt = (struct ntt *) NULL;
  
  return 0;
}

/* Delete a single node in the tree */

int ntt_delete(struct ntt *ntt, const char *key) {
  long hash_code;
  struct ntt_node *parent = NULL;
  struct ntt_node *node;
  struct ntt_node *del_node = NULL;
  
  if (ntt == NULL) return -1;
  
  hash_code = ntt_hashcode(ntt, key);
  node        = ntt->tbl[hash_code];
  
  while (node != NULL) {
    if (strcmp(key, node->key) == 0) {
      del_node = node;
      node = NULL;
    }
    
    if (del_node == NULL) {
      parent = node;
      node = node->next;
    }
  }
  
  if (del_node != NULL) {
    
    if (parent) {
      parent->next = del_node->next;
    } else {
      ntt->tbl[hash_code] = del_node->next;
    }
    
    free(del_node->key);
    free(del_node);
    ntt->items--;
    
    return 0;
  }
  
  return -5;
}

/* Point cursor to first item in tree */

struct ntt_node *c_ntt_first(struct ntt *ntt, struct ntt_c *c) {
  
  c->iter_index = 0;
  c->iter_next = (struct ntt_node *)NULL;
  return(c_ntt_next(ntt, c));
}

/* Point cursor to next iteration in tree */

struct ntt_node *c_ntt_next(struct ntt *ntt, struct ntt_c *c) {
  long index;
  struct ntt_node *node = c->iter_next;
  
  if (ntt == NULL) return NULL;
  
  if (node) {
    if (node != NULL) {
      c->iter_next = node->next;
      return (node);
    }
  }
  
  if (! node) {
    while (c->iter_index < ntt->size) {
      index = c->iter_index++;
      
      if (ntt->tbl[index]) {
	c->iter_next = ntt->tbl[index]->next;
	return(ntt->tbl[index]);
      }
    }
  }
  return((struct ntt_node *)NULL);
}

/* END NTT (Named Pointer Tree) Functions */