mod_evasive20.c

实现DOS攻击的源码

    if ((node_key = strdup(key)) == NULL) {
        free(node);
	return NULL;
    }
    node->key = node_key;
    node->timestamp = time(NULL);
    node->next = NULL;
    return(node);
}

/* Tree initializer */

struct ntt *ntt_create(long size) {
    long i = 0;
    struct ntt *ntt = (struct ntt *) malloc(sizeof(struct ntt));

    if (ntt == NULL)
        return NULL;
    while (ntt_prime_list[i] < size) { i++; }
    ntt->size  = ntt_prime_list[i];
    ntt->items = 0;
    ntt->tbl   = (struct ntt_node **) calloc(ntt->size, sizeof(struct ntt_node *));
    if (ntt->tbl == NULL) {
        free(ntt);
        return NULL;
    }
    return(ntt);
}

/* Find an object in the tree */

struct ntt_node *ntt_find(struct ntt *ntt, const char *key) {
    long hash_code;
    struct ntt_node *node;

    if (ntt == NULL) return NULL;

    hash_code = ntt_hashcode(ntt, key);
    node = ntt->tbl[hash_code];

    while (node) {
        if (!strcasecmp(key, node->key)) {
            return(node);
        }
        node = node->next;
    }
    return((struct ntt_node *)NULL);
}


/* Insert a node into the tree */

struct ntt_node *ntt_insert(struct ntt *ntt, const char *key, time_t timestamp) {
    long hash_code;
    struct ntt_node *parent;
    struct ntt_node *node;
    struct ntt_node *new_node = NULL;

    if (ntt == NULL) return NULL;

    hash_code = ntt_hashcode(ntt, key);
    parent	= NULL;
    node	= ntt->tbl[hash_code];

    while (node != NULL) {
        if (strcmp(key, node->key) == 0) { 
            new_node = node;
            node = NULL;
        }

	if (new_node == NULL) {
          parent = node;
          node = node->next;
        }
    }

    if (new_node != NULL) {
        new_node->timestamp = timestamp;
        new_node->count = 0;
        return new_node; 
    }

    /* Create a new node */
    new_node = ntt_node_create(key);
    new_node->timestamp = timestamp;
    new_node->timestamp = 0;

    ntt->items++;

    /* Insert */
    if (parent) {  /* Existing parent */
	parent->next = new_node;
        return new_node;  /* Return the locked node */
    }

    /* No existing parent; add directly to hash table */
    ntt->tbl[hash_code] = new_node;
    return new_node;
}

/* Tree destructor */

int ntt_destroy(struct ntt *ntt) {
    struct ntt_node *node, *next;
    struct ntt_c c;

    if (ntt == NULL) return -1;

    node = c_ntt_first(ntt, &c);
    while(node != NULL) {
        next = c_ntt_next(ntt, &c);
        ntt_delete(ntt, node->key);
        node = next;
    }

    free(ntt->tbl);
    free(ntt);
    ntt = (struct ntt *) NULL;

    return 0;
}

/* Delete a single node in the tree */

int ntt_delete(struct ntt *ntt, const char *key) {
    long hash_code;
    struct ntt_node *parent = NULL;
    struct ntt_node *node;
    struct ntt_node *del_node = NULL;

    if (ntt == NULL) return -1;

    hash_code = ntt_hashcode(ntt, key);
    node        = ntt->tbl[hash_code];

    while (node != NULL) {
        if (strcmp(key, node->key) == 0) {
            del_node = node;
            node = NULL;
        }

        if (del_node == NULL) {
          parent = node;
          node = node->next;
        }
    }

    if (del_node != NULL) {

        if (parent) {
            parent->next = del_node->next;
        } else {
            ntt->tbl[hash_code] = del_node->next;
        }

        free(del_node->key);
        free(del_node);
        ntt->items--;

        return 0;
    }

    return -5;
}

/* Point cursor to first item in tree */

struct ntt_node *c_ntt_first(struct ntt *ntt, struct ntt_c *c) {

    c->iter_index = 0;
    c->iter_next = (struct ntt_node *)NULL;
    return(c_ntt_next(ntt, c));
}

/* Point cursor to next iteration in tree */

struct ntt_node *c_ntt_next(struct ntt *ntt, struct ntt_c *c) {
    long index;
    struct ntt_node *node = c->iter_next;

    if (ntt == NULL) return NULL;

    if (node) {
        if (node != NULL) {
            c->iter_next = node->next;
            return (node);
        }
    }

    if (! node) {
        while (c->iter_index < ntt->size) {
            index = c->iter_index++;

            if (ntt->tbl[index]) {
                c->iter_next = ntt->tbl[index]->next;
                return(ntt->tbl[index]);
            }
        }
    }
    return((struct ntt_node *)NULL);
}

/* END NTT (Named Pointer Tree) Functions */


/* BEGIN Configuration Functions */

static const char *
get_hash_tbl_size(cmd_parms *cmd, void *dconfig, const char *value) {
  long n = strtol(value, NULL, 0);

  if (n<=0) {
    hash_table_size = DEFAULT_HASH_TBL_SIZE;
  } else  {
    hash_table_size = n;
  }

  return NULL;
}

static const char *
get_page_count(cmd_parms *cmd, void *dconfig, const char *value) {
  long n = strtol(value, NULL, 0);
  if (n<=0) {
    page_count = DEFAULT_PAGE_COUNT;
  } else {
    page_count = n;
  }

  return NULL;
}

static const char *
get_site_count(cmd_parms *cmd, void *dconfig, const char *value) {
  long n = strtol(value, NULL, 0);
  if (n<=0) {
    site_count = DEFAULT_SITE_COUNT;
  } else {
    site_count = n;
  }

  return NULL;
}

static const char *
get_page_interval(cmd_parms *cmd, void *dconfig, const char *value) {
  long n = strtol(value, NULL, 0);
  if (n<=0) {
    page_interval = DEFAULT_PAGE_INTERVAL;
  } else {
    page_interval = n;
  }

  return NULL;
}

static const char *
get_site_interval(cmd_parms *cmd, void *dconfig, const char *value) {
  long n = strtol(value, NULL, 0);
  if (n<=0) {
    site_interval = DEFAULT_SITE_INTERVAL;
  } else {
    site_interval = n;
  }

  return NULL;
}

static const char *
get_blocking_period(cmd_parms *cmd, void *dconfig, const char *value) {
  long n = strtol(value, NULL, 0);
  if (n<=0) {
    blocking_period = DEFAULT_BLOCKING_PERIOD;
  } else {
    blocking_period = n;
  }

  return NULL;
}

static const char *
get_blocking_request(cmd_parms *cmd, void *dconfig, const char *value) {
  if (value != NULL && value[0] != 0) {
    if (blocking_request != NULL)
      free(blocking_request);
    blocking_request = strdup(value);
  }

  return NULL;
}


static const char *
get_log_dir(cmd_parms *cmd, void *dconfig, const char *value) {
  if (value != NULL && value[0] != 0) {
    if (log_dir != NULL)
      free(log_dir);
    log_dir = strdup(value);
  }

  return NULL;
}

static const char *
get_email_notify(cmd_parms *cmd, void *dconfig, const char *value) {
  if (value != NULL && value[0] != 0) {
    if (email_notify != NULL)
      free(email_notify);
    email_notify = strdup(value);
  }

  return NULL;
}

static const char *
get_system_command(cmd_parms *cmd, void *dconfig, const char *value) {
  if (value != NULL && value[0] != 0) {
    if (system_command != NULL)
      free(system_command);
    system_command = strdup(value);
  }
 
  return NULL;
} 

/* END Configuration Functions */

static const command_rec access_cmds[] =
{
	AP_INIT_TAKE1("DOSHashTableSize", get_hash_tbl_size, NULL, RSRC_CONF, 
		"Set size of hash table"),

  AP_INIT_TAKE1("DOSPageCount", get_page_count, NULL, RSRC_CONF,
		"Set maximum page hit count per interval"),

  AP_INIT_TAKE1("DOSSiteCount", get_site_count, NULL, RSRC_CONF,
		"Set maximum site hit count per interval"),

  AP_INIT_TAKE1("DOSPageInterval", get_page_interval, NULL, RSRC_CONF,
		"Set page interval"),

	AP_INIT_TAKE1("DOSSiteInterval", get_site_interval, NULL, RSRC_CONF,
		"Set site interval"),

  AP_INIT_TAKE1("DOSBlockingRequest", get_blocking_request, NULL, RSRC_CONF,
		"If Set blocking request for detected DoS IPs"),

  AP_INIT_TAKE1("DOSBlockingPeriod", get_blocking_period, NULL, RSRC_CONF,
		"Set blocking period for detected DoS IPs"),

	AP_INIT_TAKE1("DOSEmailNotify", get_email_notify, NULL, RSRC_CONF,
		"Set email notification"),

	AP_INIT_TAKE1("DOSLogDir", get_log_dir, NULL, RSRC_CONF,
		"Set log dir"),

	AP_INIT_TAKE1("DOSSystemCommand", get_system_command, NULL, RSRC_CONF,
		"Set system command on DoS"),

  AP_INIT_ITERATE("DOSWhitelist", whitelist, NULL, RSRC_CONF,
                "IP-addresses wildcards to whitelist"),
                
  AP_INIT_ITERATE("DOSWhiteAgentlist", whiteagentlist, NULL, RSRC_CONF,
                "Agent properties wildcards to whitelist"),
                
  AP_INIT_ITERATE("DOSlist", whitelist, NULL, RSRC_CONF,
                "IP-addresses wildcards to whitelist"),

	{ NULL }
};

static void register_hooks(apr_pool_t *p) {
  ap_hook_access_checker(access_checker, NULL, NULL, APR_HOOK_MIDDLE);
  apr_pool_cleanup_register(p, NULL, apr_pool_cleanup_null, destroy_hit_list);
};

module AP_MODULE_DECLARE_DATA evasive20_module =
{
    STANDARD20_MODULE_STUFF,
    NULL,
    NULL,
    create_hit_list,
    NULL,
    access_cmds,
    register_hooks
};