You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modules-dev@httpd.apache.org by Rémy Sanchez <re...@hyperthese.net> on 2010/11/15 17:12:01 UTC
Shared memory ?
Hi,
I'm coding a module to somehow replace/complement mod_security (it's
more a proof of concept than a real project for now). The first thing
that I'd like to have is a DNSBL, so that detected intruders are
instantly banned when added to the blacklist. Because doing a DNS query
for each HTTP request might be a bit heavy, I'd like to keep the results
in cache.
I guess that if I create something from the config pool, it will be
duplicated between processes. But another security I want is to check
URL against regexps commonly used by botnets/script kiddies. Then, if an
IP is blacklisted, I want its state to be changed instantly in all
caches. Which, if data is duplicated, is not possible. Would there be a
simple way to achieve this ? Or would it be more clever to move to
another solution, like using a common redis datastore for
blacklist/whitelist/rules lookup ?
Thanks,
Rémy
Re: Shared memory ?
Posted by Jim Jagielski <ji...@jaguNET.com>.
With 2.3/trunk you have mod_socache and/or mod_slotmem (with shared memory).
socache implements a shared memory based expiring cache and slotmem
is a scoreboard-like shared memory impl.
On Nov 15, 2010, at 11:12 AM, Rémy Sanchez wrote:
>
> Hi,
>
> I'm coding a module to somehow replace/complement mod_security (it's more a proof of concept than a real project for now). The first thing that I'd like to have is a DNSBL, so that detected intruders are instantly banned when added to the blacklist. Because doing a DNS query for each HTTP request might be a bit heavy, I'd like to keep the results in cache.
>
> I guess that if I create something from the config pool, it will be duplicated between processes. But another security I want is to check URL against regexps commonly used by botnets/script kiddies. Then, if an IP is blacklisted, I want its state to be changed instantly in all caches. Which, if data is duplicated, is not possible. Would there be a simple way to achieve this ? Or would it be more clever to move to another solution, like using a common redis datastore for blacklist/whitelist/rules lookup ?
>
> Thanks,
> Rémy
>
Re: Shared memory ?
Posted by Rémy Sanchez <re...@hyperthese.net>.
On 11/15/2010 06:43 PM, Ben Noordhuis wrote:
> On Mon, Nov 15, 2010 at 17:12, Rémy Sanchez <re...@hyperthese.net> wrote:
>> > I'm coding a module to somehow replace/complement mod_security (it's more a
>> > proof of concept than a real project for now). The first thing that I'd like
>> > to have is a DNSBL, so that detected intruders are instantly banned when
>> > added to the blacklist. Because doing a DNS query for each HTTP request
>> > might be a bit heavy, I'd like to keep the results in cache.
> The stuff in apr_shm.h is what you want.
Thanks :) I'm getting to love APR more and more...
>> > I guess that if I create something from the config pool, it will be
>> > duplicated between processes. But another security I want is to check URL
>> > against regexps commonly used by botnets/script kiddies. Then, if an IP is
>> > blacklisted, I want its state to be changed instantly in all caches. Which,
>> > if data is duplicated, is not possible. Would there be a simple way to
>> > achieve this ? Or would it be more clever to move to another solution, like
>> > using a common redis datastore for blacklist/whitelist/rules lookup ?
> I would probably take this direction (store it in a database,
> relational or otherwise). Works across multiple nodes and is
> scriptable from outside.
Indeed, and it is much simpler than creating a specific protocol for
rules diffusion + using DNSBL to propagate blacklists as I first thought :)
--
Rémy Sanchez
http://hyperthese.net
Re: Shared memory ?
Posted by Ben Noordhuis <in...@bnoordhuis.nl>.
On Mon, Nov 15, 2010 at 17:12, Rémy Sanchez <re...@hyperthese.net> wrote:
> I'm coding a module to somehow replace/complement mod_security (it's more a
> proof of concept than a real project for now). The first thing that I'd like
> to have is a DNSBL, so that detected intruders are instantly banned when
> added to the blacklist. Because doing a DNS query for each HTTP request
> might be a bit heavy, I'd like to keep the results in cache.
The stuff in apr_shm.h is what you want.
> I guess that if I create something from the config pool, it will be
> duplicated between processes. But another security I want is to check URL
> against regexps commonly used by botnets/script kiddies. Then, if an IP is
> blacklisted, I want its state to be changed instantly in all caches. Which,
> if data is duplicated, is not possible. Would there be a simple way to
> achieve this ? Or would it be more clever to move to another solution, like
> using a common redis datastore for blacklist/whitelist/rules lookup ?
I would probably take this direction (store it in a database,
relational or otherwise). Works across multiple nodes and is
scriptable from outside.
Re: Shared memory ?
Posted by Rémy Sanchez <re...@hyperthese.net>.
On 11/15/2010 07:14 PM, Nick Kew wrote:
> Since you're at an experimental stage, there's no reason
> not to work with trunk/2.3 versions. So use the mod_socache
> framework, which is provided for precisely this kind of thing!
It's experimental, however in an idylic world it is intended to be
deployable on Red Hat 9, or at least RHEL 4 or 5. As always it is very
frustrating, but I'll avoid API less than 5 years old... sic :/
--
Rémy Sanchez
Re: Shared memory ?
Posted by Nick Kew <ni...@apache.org>.
On Mon, 15 Nov 2010 17:12:01 +0100
Rémy Sanchez <re...@hyperthese.net> wrote:
> [chop]
Since you're at an experimental stage, there's no reason
not to work with trunk/2.3 versions. So use the mod_socache
framework, which is provided for precisely this kind of thing!
--
Nick Kew