On the ipshun branch I have checked in changes for a new command-line option that enables more active defenses against attack robots.

If the "--ipshun DIRECTORY" option is included to althttpd and DIRECTORY is a full pathname (begins with "/") accessible from within the chroot jail, and if the IP address of the client appears as a file within that directory, then althttpd might return 503 Service Unavailable rather than process the request.

• If the file is zero bytes in size, then 503 is always returned. Thus you can "touch" a file that is an IP address name to permanently banish that client.

• If the file is N bytes in size, then 503 is returned if the mtime of the file is less than 60*N seconds ago. In other words, the client is banished for one minute per byte in the file.

Banishment files are automatically created if althttpd gets a request that would have resulted in a 404 Not Found, and upon examining the REQUEST_URI the request looks suspicious. Any request that include /../ is considered a hack attempt, for example. There are other common vulnerability probes that are also checked. Probably this list of vulnerability probes will grow with experience.

The banishment files are automatically unlinked after 5 minutes/byte.

Banishment files are initially 1 bytes in size. But if a banishment expires and then a new attack is detected prior to 5 min/byte cleanup time, then the file grows by one byte and the mtime is reset.

Motivation

There was a nasty robot yesterday that was filling out forms and causing problems. It appeared to be the same robot, though two separate IP addresses, one from Cyprus and the other from Hungary. I've long since null-routed both of those IP addresses. This enhancement, had it been deployed yesterday, would have likely blocked that robot prior to it causing problems.

Using The Filesystem As A Database

Why not keep the list of shunned IP addresses in (say) an SQLite database? Because while SQLite is very fast (even faster than stat()) once it gets initialized, there is a lot of initialization to the database to get it up and running. For example, it has to read and parse the schema every time it is opened. I don't want to introduce that much overhead for every incoming HTTP request. As currently designed, we do a single stat() system call to determine whether or not the IP address should be shunned.