Apache DoS Module Patch (WAS RE: DOS ATTACK)

From: Jonathan A. Zdziarski (jonathan@networkdweebs.com)
Date: 10/29/02 

From: "Jonathan A. Zdziarski" <jonathan@networkdweebs.com>
To: "'Hunt, Jim'" <Jim.Hunt@nwsc.k12.in.us>
Date: Mon, 28 Oct 2002 23:41:30 -0500

Attached is my first attempt to see how difficult it would be to write
an anti-DoS patch for Apache (I did a few searches and didn't see one
that already existed). The enclosed files modify mod_access.c (Apache
1.3.26) so that each listener keeps an internal table of ip addresses
and urls requested; no listener should service more than 1 or 2 requests
for the same page by the same ip address without spitting out a 403. It
doesn't seem to use much memory at all, but I suspect on heavily loaded
systems it may use more.

After some testing, it was apparent this didn't seem to interfere with
valid user traffic at all (even if the user refreshed quickly), but was
very successful at beating down a script attack.

Since this works on a per-listener basis, it automatically purges itself
when the listener recycles. Each listener keeps its own record, so
while it may not reject the first 10 or 20 requests, in the event of a
real DoS (e.g. several hundred requests), it appears works quite well.

Anyway, I'd be interested in any feedback about this; if it's useful and
there's not something like it already, I'd be glad to write it into a
"real" apache module rather than hacking mod_access up.

Instructions:

Configure first...then extract into src/modules/standard. This will
replace mod_access.c and extract npt.h, npt.c, and Makefile.patch. The
npt files are some basic dynamic hash array functions and the
Makefile.patch should be applied to add npt.o to the OBJS in the
Makefile.

If you have a heavily loaded web server, you may consider increasing the
hash table size (search for 'npt_create' in mod_access.c)

Let me know if this is useful to anyone.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • Apache/Tomcat Denial Of Service And Information Leakage Vulnerability
    ... mod_jk 1.2 using Apache Jserv Protocol 1.3 ... Tomcat 4.x Server ... A client may connect to the target machine and deliver several requests ... response back over the connection. ...
    (Bugtraq)
  • FreeBSD 6 Jails - REJ apache processes? [was: Apache 2 in 6.0 jails: Connection refused: connect
    ... Sorry to insist, really, but this bug is really annoying: today, two more apache servers have frozen while being scanner by a crawler: ... I did the same for sockstat and netstat -a, each time before and after the apache restart: ... Connection refused: connect to listener on 0.0.0.0:80 [Sat Jul ...
    (freebsd-questions)
  • Re: [PHP] problem with url_fopen on free hosting environment
    ... I just blocked all tcp requests on port 80 and 443 comming from my own outside IP. ... I know it just limits new connections, and I thought this would work out, but it didn't. ... There's also mod_bandwidth for Apache, not included in the aforementioned topic. ... "All information in this email message, including images, attachments, contains confidential and proprietary information of BESTPLACE CORPORATION and should only be used or serves for the intended purpose and should not be copied, used or disclosed to anyone other than the sole recipient of this e-mail message." ...
    (php.general)
  • Re: Thoughts on mod_lisp
    ... >> lisp based server. ... > (which uses sockets to connect to apache) or mod_proxy. ... 0.68 (mean, across all concurrent requests) ...
    (comp.lang.lisp)
  • Re: [Full-disclosure] Apache Illegal Request Handling Possible XSS Vulnerability
    ... So that implies that Apache is being slightly lax in passing arbitrary ... I think that server should have a list of valid requests. ... as request and protocol makes no sense. ... Albion Wharf, 19 Albion Street, Manchester, M1 5LN, England ...
    (Full-Disclosure)