public class DoSFilter extends Object implements Filter
This filter is useful for limiting exposure to abuse from request flooding, whether malicious, or as a result of a misconfigured client.
The filter keeps track of the number of requests from a connection per second. If a limit is exceeded, the request is either rejected, delayed, or throttled.
When a request is throttled, it is placed in a priority queue. Priority is given first to authenticated users and users with an HttpSession, then connections which can be identified by their IP addresses. Connections with no way to identify them are given lowest priority.
The extractUserId(ServletRequest request)
function should be
implemented, in order to uniquely identify authenticated users.
The following init parameters control the behavior of the filter:
ServletContext
attribute with the
filter name as the attribute name. This allows context external mechanism (eg JMX via ContextHandler.MANAGED_ATTRIBUTES
) to
manage the configuration of the filter.Constructor and Description |
---|
DoSFilter() |
Modifier and Type | Method and Description |
---|---|
boolean |
addWhitelistAddress(String address) |
protected boolean |
checkWhitelist(List<String> whitelist,
String candidate) |
void |
clearWhitelist() |
protected void |
closeConnection(HttpServletRequest request,
HttpServletResponse response,
Thread thread)
Takes drastic measures to return this response and stop this thread.
|
void |
destroy() |
protected void |
doFilter(HttpServletRequest request,
HttpServletResponse response,
FilterChain filterChain) |
void |
doFilter(ServletRequest request,
ServletResponse response,
FilterChain filterChain) |
protected void |
doFilterChain(FilterChain chain,
HttpServletRequest request,
HttpServletResponse response) |
protected String |
extractUserId(ServletRequest request)
Returns the user id, used to track this connection.
|
long |
getDelayMs()
Get delay (in milliseconds) that is applied to all requests
over the rate limit, before they are considered at all.
|
long |
getMaxIdleTrackerMs()
Get maximum amount of time (in milliseconds) to keep track
of request rates for a connection, before deciding that
the user has gone away, and discarding it.
|
protected int |
getMaxPriority() |
long |
getMaxRequestMs()
Get maximum amount of time (in milliseconds) to allow
the request to process.
|
int |
getMaxRequestsPerSec()
Get maximum number of requests from a connection per
second.
|
long |
getMaxWaitMs()
Get maximum amount of time (in milliseconds) the filter will
blocking wait for the throttle semaphore.
|
protected int |
getPriority(HttpServletRequest request,
org.eclipse.jetty.servlets.DoSFilter.RateTracker tracker)
Get priority for this request, based on user type
|
org.eclipse.jetty.servlets.DoSFilter.RateTracker |
getRateTracker(ServletRequest request)
Return a request rate tracker associated with this connection; keeps
track of this connection's request rate.
|
int |
getThrottledRequests()
Get number of requests over the rate limit able to be
considered at once.
|
long |
getThrottleMs()
Get amount of time (in milliseconds) to async wait for semaphore.
|
String |
getWhitelist()
Get a list of IP addresses that will not be rate limited.
|
void |
init(FilterConfig filterConfig) |
boolean |
isEnabled() |
boolean |
isInsertHeaders()
Check flag to insert the DoSFilter headers into the response.
|
boolean |
isRemotePort()
Get flag to have usage rate tracked by IP+port (effectively connection)
if session tracking is not used.
|
boolean |
isTrackSessions()
Get flag to have usage rate tracked by session if a session exists.
|
boolean |
removeWhitelistAddress(String address) |
void |
setDelayMs(long value)
Set delay (in milliseconds) that is applied to all requests
over the rate limit, before they are considered at all.
|
void |
setEnabled(boolean enabled) |
void |
setInsertHeaders(boolean value)
Set flag to insert the DoSFilter headers into the response.
|
void |
setMaxIdleTrackerMs(long value)
Set maximum amount of time (in milliseconds) to keep track
of request rates for a connection, before deciding that
the user has gone away, and discarding it.
|
void |
setMaxRequestMs(long value)
Set maximum amount of time (in milliseconds) to allow
the request to process.
|
void |
setMaxRequestsPerSec(int value)
Get maximum number of requests from a connection per
second.
|
void |
setMaxWaitMs(long value)
Set maximum amount of time (in milliseconds) the filter will
blocking wait for the throttle semaphore.
|
void |
setRemotePort(boolean value)
Set flag to have usage rate tracked by IP+port (effectively connection)
if session tracking is not used.
|
void |
setThrottledRequests(int value)
Set number of requests over the rate limit able to be
considered at once.
|
void |
setThrottleMs(long value)
Set amount of time (in milliseconds) to async wait for semaphore.
|
void |
setTrackSessions(boolean value)
Set flag to have usage rate tracked by session if a session exists.
|
void |
setWhitelist(String value)
Set a list of IP addresses that will not be rate limited.
|
protected boolean |
subnetMatch(String subnetAddress,
String address) |
public void init(FilterConfig filterConfig)
public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException
doFilter
in interface Filter
IOException
ServletException
protected void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException
IOException
ServletException
protected void doFilterChain(FilterChain chain, HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException
IOException
ServletException
protected void closeConnection(HttpServletRequest request, HttpServletResponse response, Thread thread)
request
- current requestresponse
- current response, which must be stoppedthread
- the handling threadprotected int getPriority(HttpServletRequest request, org.eclipse.jetty.servlets.DoSFilter.RateTracker tracker)
request
- the current requesttracker
- the rate tracker for this requestprotected int getMaxPriority()
public org.eclipse.jetty.servlets.DoSFilter.RateTracker getRateTracker(ServletRequest request)
request
- the current requestprotected String extractUserId(ServletRequest request)
request
- the current requestpublic int getMaxRequestsPerSec()
public void setMaxRequestsPerSec(int value)
value
- maximum number of requestspublic long getDelayMs()
public void setDelayMs(long value)
value
- delay (in milliseconds), 0 - no delay, -1 - reject requestpublic long getMaxWaitMs()
public void setMaxWaitMs(long value)
value
- maximum wait timepublic int getThrottledRequests()
public void setThrottledRequests(int value)
value
- number of requestspublic long getThrottleMs()
public void setThrottleMs(long value)
value
- wait timepublic long getMaxRequestMs()
public void setMaxRequestMs(long value)
value
- maximum processing timepublic long getMaxIdleTrackerMs()
public void setMaxIdleTrackerMs(long value)
value
- maximum tracking timepublic boolean isInsertHeaders()
public void setInsertHeaders(boolean value)
value
- value of the flagpublic boolean isTrackSessions()
public void setTrackSessions(boolean value)
value
- value of the flagpublic boolean isRemotePort()
public void setRemotePort(boolean value)
value
- value of the flagpublic boolean isEnabled()
public void setEnabled(boolean enabled)
enabled
- whether this filter is enabledpublic String getWhitelist()
public void setWhitelist(String value)
value
- comma-separated whitelistpublic void clearWhitelist()
public boolean addWhitelistAddress(String address)
public boolean removeWhitelistAddress(String address)
Copyright © 1995-2013 Mort Bay Consulting. All Rights Reserved.