[half solved] lNet Attack :) lazarus / 38-Networking and Web Programming ---------------------------------------------------------------------- gulyone · 2013-02-27 21:23 Hi there ! I'm using lNet components (package version 6.6 latest from svn) on lazarus 1.0.4 windows 7. I just noticed that TLTcp class while used as server does not have any garbage on inactive connected client sockets. So if a hacker connects hundreds and hundreds times on a lNet TLTcp server just sending no data , it is going to hang, flooding server's system resources. I saw inside the package code an attempt to use a timeout for such cases , but most of the lines are turned into comments by the author... any suggestion here ? to wrap around such a situation and fight hacking ? thx by advance. N.B. it seems to be the same , whatever TEventer descendant u choose for managing TLConnection AVLTree, at least on windows (TThreadEventer, TSelectEventer) http://wiki.freepascal.org/lNet http://lnet.wordpress.com/ ---------------------------------------------------------------------- Almindor · 2013-02-28 03:46 This is a bit of a problem. There's no sure way to detect such behavior from normal connections (especially on a really busy server). One way to fight it specifically would be to implement a per-socket timeout system. The most easy is to add a timeout structure (or just a number) to the socket's userdata and keep a list of sockets. Then use a periodic check (you can do it when you do CallAction) and loop all of them to see if they are timed out. You should of course update the timeout record on each socket's activity like onReceive etc. Ales ---------------------------------------------------------------------- gulyone · 2013-02-28 04:51 Quote from: Almindor on February 28, 2013, 04:46:11 amThis is a bit of a problem. There's no sure way to detect such behavior from normal connections (especially on a really busy server). One way to fight it specifically would be to implement a per-socket timeout system. The most easy is to add a timeout structure (or just a number) to the socket's userdata and keep a list of sockets. Then use a periodic check (you can do it when you do CallAction) and loop all of them to see if they are timed out. You should of course update the timeout record on each socket's activity like onReceive etc. Ales TY Sir  , I tried it with a generic TMap kinda ... but I easily stressed out my server, managing this huge map.. then I thought and I thought ... annd finally , found out an easy way to solve the problem , as follow : Create a TStrings ; each time a client connects , put its TLSocket.PeerAddress into that TStrings (can be a Lazarus TStringList) if this TStrings object does not already contains that Ip Address , in case of it already exists in the TSrings.IndexOf(TLSocket.PeerAddress) , just disconnect , because that ip already IS connected. furthermore , even if i need 2, 3 connections from same Ip on different ports , I can do a TStringList per port. Okay its not yet a great solution , but it patches hackers massive attacks from same Ip. I'm gona try to change the StringList wich takes much memoy into a kinda in_addrList . If succesful , i'll incorporate this into your wonderful lNets components as an option (like MaxConPerIp) to the server component and will let you know. yep ! I used Indy by past , prefer lNet since i tried. You did cool and GREAT JOB ! Almindor ---------------------------------------------------------------------- gulyone · 2013-02-28 05:11 a max of 4 connections from same ip sounds good enough (families having more computers than that behind a router are rare) i will look in that direction for a solution. record   ip : address   ConnectionCount : integer end List of that record on new connection , Create new Record if not exists, ConnectionCount +1, if ConnectionCount > MaxConPerIp then refuse this new connection on disconnect find the record by ip:address, ConnectionCount -1, if ConnectionCount=0, Free the record from List ---------------------------------------------------------------------- fastblade · 2013-02-28 06:56 thanks to Almindor first, you lnet is a very excellent package. As my experience, I use lnet create a TCP server under FreeBSD, the most concurrent connections exceed more than 3700, it works very well. Must to pervent the long time hung connection if you want to write a public server, I can not find out a good way, so, I treated it in every single socket. define a user node such as Code: [Select]TSingleUser = class  private   ......   activeTime : TDateTime;   function checkIfIdle_or_hung : Byte;  public   idleTime : integer;   hungTime : integer;   thesocket : TLSocket;   ...... end; Create a node for every onAccept event, and start record the action of this node when onRead, onWrite, etc... , and remeber to free node when onDisconnect... In the main loop, after TCP's callaction, check every node's status and do what you want... Sometimes, you must pervent a connection to wild guess the password use a robot if you server want user to use password to log in, so, maybe, you should push a connection to a blackbox and let it hung as long as you want(you should record the ip of this node), for this operation, the robot can not get back message so it can not do the next guess operation. Maybe, some time you should block more connections come from same IP address.  etc... Maybe not the best solution, but it works. ---------------------------------------------------------------------- fastblade · 2013-02-28 09:06 In fact, I found the socket hung on server and have no any action not increase burden of the server any more. I have write a simulator and run in 10 computers to create 2000 connections to a server, the server works very easy. ---------------------------------------------------------------------- BigChimp · 2013-02-28 14:27 Quote from: gulyone on February 28, 2013, 06:11:03 ama max of 4 connections from same ip sounds good enough (families having more computers than that behind a router are rare) i will look in that direction for a solution. Don't know if you want to incorporate limiting # of connections per IP into lnet but please be aware of corporate proxies that probably will have many more than 4 connections (depending on your client base etc.) ---------------------------------------------------------------------- BigChimp · 2013-02-28 14:29 Quote from: fastblade on February 28, 2013, 07:56:03 amMust to pervent the long time hung connection if you want to write a public server, I can not find out a good way, so, I treated it in every single socket. define a user node such as Create a node for every onAccept event, and start record the action of this node when onRead, onWrite, etc... , and remeber to free node when onDisconnect... In the main loop, after TCP's callaction, check every node's status and do what you want... Sometimes, you must pervent a connection to wild guess the password use a robot if you server want user to use password to log in, so, maybe, you should push a connection to a blackbox and let it hung as long as you want(you should record the ip of this node), for this operation, the robot can not get back message so it can not do the next guess operation. Maybe, some time you should block more connections come from same IP address.  etc... Maybe not the best solution, but it works. That sounds good ---------------------------------------------------------------------- gulyone · 2013-02-28 19:02 Quote from: BigChimp on February 28, 2013, 03:27:53 pmQuote from: gulyone on February 28, 2013, 06:11:03 ama max of 4 connections from same ip sounds good enough (families having more computers than that behind a router are rare) i will look in that direction for a solution. Don't know if you want to incorporate limiting # of connections per IP into lnet but please be aware of corporate proxies that probably will have many more than 4 connections (depending on your client base etc.) yep , limitin # of connections per ip is a security big point to my safe server ... to ppl hiding behind firewall , vpn and etc .. Go Hide elsewhere ! So my solution is the best. darkness grows by growing shadows !! always prefer the light ! especialy when security matters !!! ---------------------------------------------------------------------- gulyone · 2013-02-28 21:13 hmmm , and what about that code I just wrote , no matter the Ips, just the lazy connections , according to Dark Bigchrimp .. and prepare future onTooMuchBadCmd --> Disconnect ---------------------------------------------------------------------- Almindor · 2013-02-28 22:39 lNet is the library, all of this logic is userland and per use-case so I will not push any limiting code into lnet itself. There might be some external sessions which could do this too (plugin-style like SSL is done) and if the code is good it could end up in the repo. ---------------------------------------------------------------------- BigChimp · 2013-03-01 06:03 Quote from: gulyone on February 28, 2013, 08:02:15 pmyep , limitin # of connections per ip is a security big point to my safe server ... to ppl hiding behind firewall , vpn and etc .. Go Hide elsewhere ! Sorry Gulyone, I have a lot of trouble understanding your posts. Apparently you want to increase security by limiting connections per IP yet you disapprove of firewalls? Quote from: gulyone link=topic=20079and prepare future onTooMuchBadCmd --> Disconnect ... and it doesn't help that you often add in snippets of non- idiomatic English instead of actual sentences... ---------------------------------------------------------------------- gulyone · 2013-03-01 07:13 Quote from: BigChimp on March 01, 2013, 07:03:24 amQuote from: gulyone on February 28, 2013, 08:02:15 pmyep , limitin # of connections per ip is a security big point to my safe server ... to ppl hiding behind firewall , vpn and etc .. Go Hide elsewhere ! Sorry Gulyone, I have a lot of trouble understanding your posts. Apparently you want to increase security by limiting connections per IP yet you disapprove of firewalls? Quote from: gulyone link=topic=20079and prepare future onTooMuchBadCmd --> Disconnect ... and it doesn't help that you often add in snippets of non- idiomatic English instead of actual sentences... Big kisses from Jeanne d'Arc and Monsieur de Lafayette idiomatic ? english is idio so whatever matic ? Quand tu parleras ma langue aussi bien que je parle la tienne, je me les mettrais sur un billot et je me les couperais moi-même ---------------------------------------------------------------------- BigChimp · 2013-03-01 07:26 Unfortunately, that was more or less what I expected. I think I'm done here.