XRPLF · kuznetsss · Aug 13, 2024 · Aug 13, 2024 · Aug 13, 2024
diff --git a/src/app/ClioApplication.cpp b/src/app/ClioApplication.cpp
@@ -33,11 +33,11 @@
 #include "util/config/Config.hpp"
 #include "util/log/Logger.hpp"
 #include "util/prometheus/Prometheus.hpp"
-#include "web/DOSGuard.hpp"
-#include "web/IntervalSweepHandler.hpp"
 #include "web/RPCServerHandler.hpp"
 #include "web/Server.hpp"
-#include "web/WhitelistHandler.hpp"
+#include "web/dosguard/DOSGuard.hpp"
+#include "web/dosguard/IntervalSweepHandler.hpp"
+#include "web/dosguard/WhitelistHandler.hpp"
 
 #include <boost/asio/io_context.hpp>
 
@@ -93,9 +93,9 @@ ClioApplication::run()
     boost::asio::io_context ioc{threads};
 
     // Rate limiter, to prevent abuse
-    auto whitelistHandler = web::WhitelistHandler{config_};
-    auto dosGuard = web::DOSGuard{config_, whitelistHandler};
-    auto sweepHandler = web::IntervalSweepHandler{config_, ioc, dosGuard};
+    auto whitelistHandler = web::dosguard::WhitelistHandler{config_};
+    auto dosGuard = web::dosguard::DOSGuard{config_, whitelistHandler};
+    auto sweepHandler = web::dosguard::IntervalSweepHandler{config_, ioc, dosGuard};
 
     // Interface to the database
     auto backend = data::make_Backend(config_);

diff --git a/src/rpc/RPCEngine.hpp b/src/rpc/RPCEngine.hpp
@@ -28,7 +28,7 @@
 #include "rpc/common/impl/ForwardingProxy.hpp"
 #include "util/log/Logger.hpp"
 #include "web/Context.hpp"
-#include "web/DOSGuard.hpp"
+#include "web/dosguard/DOSGuardInterface.hpp"
 
 #include <boost/asio/spawn.hpp>
 #include <boost/json.hpp>
@@ -65,7 +65,7 @@ class RPCEngine {
     util::Logger log_{"RPC"};
 
     std::shared_ptr<BackendInterface> backend_;
-    std::reference_wrapper<web::DOSGuard const> dosGuard_;
+    std::reference_wrapper<web::dosguard::DOSGuardInterface const> dosGuard_;
     std::reference_wrapper<WorkQueue> workQueue_;
     std::reference_wrapper<Counters> counters_;
 
@@ -87,7 +87,7 @@ class RPCEngine {
     RPCEngine(
         std::shared_ptr<BackendInterface> const& backend,
         std::shared_ptr<etl::LoadBalancer> const& balancer,
-        web::DOSGuard const& dosGuard,
+        web::dosguard::DOSGuardInterface const& dosGuard,
         WorkQueue& workQueue,
         Counters& counters,
         std::shared_ptr<HandlerProvider const> const& handlerProvider
@@ -116,7 +116,7 @@ class RPCEngine {
     make_RPCEngine(
         std::shared_ptr<BackendInterface> const& backend,
         std::shared_ptr<etl::LoadBalancer> const& balancer,
-        web::DOSGuard const& dosGuard,
+        web::dosguard::DOSGuardInterface const& dosGuard,
         WorkQueue& workQueue,
         Counters& counters,
         std::shared_ptr<HandlerProvider const> const& handlerProvider

diff --git a/src/web/CMakeLists.txt b/src/web/CMakeLists.txt
@@ -1,8 +1,15 @@
 add_library(clio_web)
 
 target_sources(
-  clio_web PRIVATE impl/AdminVerificationStrategy.cpp impl/ServerSslContext.cpp IntervalSweepHandler.cpp Resolver.cpp
-                   Server.cpp
+  clio_web
+  PRIVATE Resolver.cpp
+          Server.cpp
+          dosguard/DOSGuard.cpp
+          dosguard/IntervalSweepHandler.cpp
+          dosguard/WhitelistHandler.cpp
+          impl/AdminVerificationStrategy.cpp
+          impl/ServerSslContext.cpp
+          ng/Server.cpp
 )
 
 target_link_libraries(clio_web PUBLIC clio_util)
diff --git a/src/web/HttpSession.hpp b/src/web/HttpSession.hpp
@@ -20,8 +20,8 @@
 #pragma once
 
 #include "util/Taggable.hpp"
-#include "web/DOSGuard.hpp"
 #include "web/PlainWsSession.hpp"
+#include "web/dosguard/DOSGuardInterface.hpp"
 #include "web/impl/HttpBase.hpp"
 #include "web/interface/ConnectionBase.hpp"
 
@@ -70,7 +70,7 @@ class HttpSession : public impl::HttpBase<HttpSession, HandlerType>,
         std::string const& ip,
         std::shared_ptr<impl::AdminVerificationStrategy> const& adminVerification,
         std::reference_wrapper<util::TagDecoratorFactory const> tagFactory,
-        std::reference_wrapper<web::DOSGuard> dosGuard,
+        std::reference_wrapper<dosguard::DOSGuardInterface> dosGuard,
         std::shared_ptr<HandlerType> const& handler,
         boost::beast::flat_buffer buffer
     )

diff --git a/src/web/PlainWsSession.hpp b/src/web/PlainWsSession.hpp
@@ -20,7 +20,7 @@
 #pragma once
 
 #include "util/Taggable.hpp"
-#include "web/DOSGuard.hpp"
+#include "web/dosguard/DOSGuardInterface.hpp"
 #include "web/impl/WsBase.hpp"
 #include "web/interface/ConnectionBase.hpp"
 
@@ -68,7 +68,7 @@ class PlainWsSession : public impl::WsBase<PlainWsSession, HandlerType> {
         boost::asio::ip::tcp::socket&& socket,
         std::string ip,
         std::reference_wrapper<util::TagDecoratorFactory const> tagFactory,
-        std::reference_wrapper<web::DOSGuard> dosGuard,
+        std::reference_wrapper<dosguard::DOSGuardInterface> dosGuard,
         std::shared_ptr<HandlerType> const& handler,
         boost::beast::flat_buffer&& buffer,
         bool isAdmin
@@ -102,7 +102,7 @@ class WsUpgrader : public std::enable_shared_from_this<WsUpgrader<HandlerType>>
     boost::optional<http::request_parser<http::string_body>> parser_;
     boost::beast::flat_buffer buffer_;
     std::reference_wrapper<util::TagDecoratorFactory const> tagFactory_;
-    std::reference_wrapper<web::DOSGuard> dosGuard_;
+    std::reference_wrapper<dosguard::DOSGuardInterface> dosGuard_;
     http::request<http::string_body> req_;
     std::string ip_;
     std::shared_ptr<HandlerType> const handler_;
@@ -125,7 +125,7 @@ class WsUpgrader : public std::enable_shared_from_this<WsUpgrader<HandlerType>>
         boost::beast::tcp_stream&& stream,
         std::string ip,
         std::reference_wrapper<util::TagDecoratorFactory const> tagFactory,
-        std::reference_wrapper<web::DOSGuard> dosGuard,
+        std::reference_wrapper<dosguard::DOSGuardInterface> dosGuard,
         std::shared_ptr<HandlerType> const& handler,
         boost::beast::flat_buffer&& buffer,
         http::request<http::string_body> request,

diff --git a/src/web/Server.hpp b/src/web/Server.hpp
@@ -21,9 +21,9 @@
 
 #include "util/Taggable.hpp"
 #include "util/log/Logger.hpp"
-#include "web/DOSGuard.hpp"
 #include "web/HttpSession.hpp"
 #include "web/SslHttpSession.hpp"
+#include "web/dosguard/DOSGuardInterface.hpp"
 #include "web/impl/ServerSslContext.hpp"
 #include "web/interface/Concepts.hpp"
 
@@ -91,7 +91,7 @@ class Detector : public std::enable_shared_from_this<Detector<PlainSessionType,
     boost::beast::tcp_stream stream_;
     std::optional<std::reference_wrapper<boost::asio::ssl::context>> ctx_;
     std::reference_wrapper<util::TagDecoratorFactory const> tagFactory_;
-    std::reference_wrapper<web::DOSGuard> const dosGuard_;
+    std::reference_wrapper<dosguard::DOSGuardInterface> const dosGuard_;
     std::shared_ptr<HandlerType> const handler_;
     boost::beast::flat_buffer buffer_;
     std::shared_ptr<impl::AdminVerificationStrategy> const adminVerification_;
@@ -111,7 +111,7 @@ class Detector : public std::enable_shared_from_this<Detector<PlainSessionType,
         tcp::socket&& socket,
         std::optional<std::reference_wrapper<boost::asio::ssl::context>> ctx,
         std::reference_wrapper<util::TagDecoratorFactory const> tagFactory,
-        std::reference_wrapper<web::DOSGuard> dosGuard,
+        std::reference_wrapper<dosguard::DOSGuardInterface> dosGuard,
         std::shared_ptr<HandlerType> handler,
         std::shared_ptr<impl::AdminVerificationStrategy> adminVerification
     )
@@ -213,7 +213,7 @@ class Server : public std::enable_shared_from_this<Server<PlainSessionType, SslS
     std::reference_wrapper<boost::asio::io_context> ioc_;
     std::optional<boost::asio::ssl::context> ctx_;
     util::TagDecoratorFactory tagFactory_;
-    std::reference_wrapper<web::DOSGuard> dosGuard_;
+    std::reference_wrapper<dosguard::DOSGuardInterface> dosGuard_;
     std::shared_ptr<HandlerType> handler_;
     tcp::acceptor acceptor_;
     std::shared_ptr<impl::AdminVerificationStrategy> adminVerification_;
@@ -235,7 +235,7 @@ class Server : public std::enable_shared_from_this<Server<PlainSessionType, SslS
         std::optional<boost::asio::ssl::context> ctx,
         tcp::endpoint endpoint,
         util::TagDecoratorFactory tagFactory,
-        web::DOSGuard& dosGuard,
+        dosguard::DOSGuardInterface& dosGuard,
         std::shared_ptr<HandlerType> handler,
         std::optional<std::string> adminPassword
     )
@@ -327,7 +327,7 @@ static std::shared_ptr<HttpServer<HandlerType>>
 make_HttpServer(
     util::Config const& config,
     boost::asio::io_context& ioc,
-    web::DOSGuard& dosGuard,
+    dosguard::DOSGuardInterface& dosGuard,
     std::shared_ptr<HandlerType> const& handler
 )
 {

diff --git a/src/web/SslHttpSession.hpp b/src/web/SslHttpSession.hpp
@@ -20,9 +20,10 @@
 #pragma once
 
 #include "util/Taggable.hpp"
-#include "web/DOSGuard.hpp"
 #include "web/SslWsSession.hpp"
+#include "web/dosguard/DOSGuardInterface.hpp"
 #include "web/impl/HttpBase.hpp"
+#include "web/interface/Concepts.hpp"
 #include "web/interface/ConnectionBase.hpp"
 
 #include <boost/asio/ip/tcp.hpp>
@@ -78,7 +79,7 @@ class SslHttpSession : public impl::HttpBase<SslHttpSession, HandlerType>,
         std::shared_ptr<impl::AdminVerificationStrategy> const& adminVerification,
         boost::asio::ssl::context& ctx,
         std::reference_wrapper<util::TagDecoratorFactory const> tagFactory,
-        std::reference_wrapper<web::DOSGuard> dosGuard,
+        std::reference_wrapper<dosguard::DOSGuardInterface> dosGuard,
         std::shared_ptr<HandlerType> const& handler,
         boost::beast::flat_buffer buffer
     )

diff --git a/src/web/SslWsSession.hpp b/src/web/SslWsSession.hpp
@@ -20,7 +20,7 @@
 #pragma once
 
 #include "util/Taggable.hpp"
-#include "web/DOSGuard.hpp"
+#include "web/dosguard/DOSGuardInterface.hpp"
 #include "web/impl/WsBase.hpp"
 #include "web/interface/ConnectionBase.hpp"
 
@@ -69,7 +69,7 @@ class SslWsSession : public impl::WsBase<SslWsSession, HandlerType> {
         boost::beast::ssl_stream<boost::beast::tcp_stream>&& stream,
         std::string ip,
         std::reference_wrapper<util::TagDecoratorFactory const> tagFactory,
-        std::reference_wrapper<web::DOSGuard> dosGuard,
+        std::reference_wrapper<dosguard::DOSGuardInterface> dosGuard,
         std::shared_ptr<HandlerType> const& handler,
         boost::beast::flat_buffer&& buffer,
         bool isAdmin
@@ -102,7 +102,7 @@ class SslWsUpgrader : public std::enable_shared_from_this<SslWsUpgrader<HandlerT
     boost::beast::flat_buffer buffer_;
     std::string ip_;
     std::reference_wrapper<util::TagDecoratorFactory const> tagFactory_;
-    std::reference_wrapper<web::DOSGuard> dosGuard_;
+    std::reference_wrapper<dosguard::DOSGuardInterface> dosGuard_;
     std::shared_ptr<HandlerType> const handler_;
     http::request<http::string_body> req_;
     bool isAdmin_;
@@ -124,7 +124,7 @@ class SslWsUpgrader : public std::enable_shared_from_this<SslWsUpgrader<HandlerT
         boost::beast::ssl_stream<boost::beast::tcp_stream> stream,
         std::string ip,
         std::reference_wrapper<util::TagDecoratorFactory const> tagFactory,
-        std::reference_wrapper<web::DOSGuard> dosGuard,
+        std::reference_wrapper<dosguard::DOSGuardInterface> dosGuard,
         std::shared_ptr<HandlerType> handler,
         boost::beast::flat_buffer&& buffer,
         http::request<http::string_body> request,

diff --git a/src/web/dosguard/DOSGuard.cpp b/src/web/dosguard/DOSGuard.cpp
@@ -0,0 +1,148 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of clio: https://github.com/XRPLF/clio
+    Copyright (c) 2024, the clio developers.
+
+   Permission to use, copy, modify, and distribute this software for any
+    purpose with or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL,  DIRECT,  INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#include "web/dosguard/DOSGuard.hpp"
+
+#include "util/Assert.hpp"
+#include "util/config/Config.hpp"
+#include "util/log/Logger.hpp"
+#include "web/dosguard/WhitelistHandlerInterface.hpp"
+
+#include <boost/iterator/transform_iterator.hpp>
+
+#include <cstdint>
+#include <functional>
+#include <mutex>
+#include <string>
+#include <string_view>
+#include <unordered_set>
+
+namespace web::dosguard {
+
+DOSGuard::DOSGuard(util::Config const& config, WhitelistHandlerInterface const& whitelistHandler)
+    : whitelistHandler_{std::cref(whitelistHandler)}
+    , maxFetches_{config.valueOr("dos_guard.max_fetches", DEFAULT_MAX_FETCHES)}
+    , maxConnCount_{config.valueOr("dos_guard.max_connections", DEFAULT_MAX_CONNECTIONS)}
+    , maxRequestCount_{config.valueOr("dos_guard.max_requests", DEFAULT_MAX_REQUESTS)}
+{
+}
+
+[[nodiscard]] bool
+DOSGuard::isWhiteListed(std::string_view const ip) const noexcept
+{
+    return whitelistHandler_.get().isWhiteListed(ip);
+}
+
+[[nodiscard]] bool
+DOSGuard::isOk(std::string const& ip) const noexcept
+{
+    if (whitelistHandler_.get().isWhiteListed(ip))
+        return true;
+
+    {
+        std::scoped_lock const lck(mtx_);
+        if (ipState_.find(ip) != ipState_.end()) {
+            auto [transferedByte, requests] = ipState_.at(ip);
+            if (transferedByte > maxFetches_ || requests > maxRequestCount_) {
+                LOG(log_.warn()) << "Dosguard: Client surpassed the rate limit. ip = " << ip
+                                 << " Transfered Byte: " << transferedByte << "; Requests: " << requests;
+                return false;
+            }
+        }
+        auto it = ipConnCount_.find(ip);
+        if (it != ipConnCount_.end()) {
+            if (it->second > maxConnCount_) {
+                LOG(log_.warn()) << "Dosguard: Client surpassed the rate limit. ip = " << ip
+                                 << " Concurrent connection: " << it->second;
+                return false;
+            }
+        }
+    }
+    return true;
+}
+
+void
+DOSGuard::increment(std::string const& ip) noexcept
+{
+    if (whitelistHandler_.get().isWhiteListed(ip))
+        return;
+    std::scoped_lock const lck{mtx_};
+    ipConnCount_[ip]++;
+}
+
+void
+DOSGuard::decrement(std::string const& ip) noexcept
+{
+    if (whitelistHandler_.get().isWhiteListed(ip))
+        return;
+    std::scoped_lock const lck{mtx_};
+    ASSERT(ipConnCount_[ip] > 0, "Connection count for ip {} can't be 0", ip);
+    ipConnCount_[ip]--;
+    if (ipConnCount_[ip] == 0)
+        ipConnCount_.erase(ip);
+}
+
+[[maybe_unused]] bool
+DOSGuard::add(std::string const& ip, uint32_t numObjects) noexcept
+{
+    if (whitelistHandler_.get().isWhiteListed(ip))
+        return true;
+
+    {
+        std::scoped_lock const lck(mtx_);
+        ipState_[ip].transferedByte += numObjects;
+    }
+
+    return isOk(ip);
+}
+
+[[maybe_unused]] bool
+DOSGuard::request(std::string const& ip) noexcept
+{
+    if (whitelistHandler_.get().isWhiteListed(ip))
+        return true;
+
+    {
+        std::scoped_lock const lck(mtx_);
+        ipState_[ip].requestsCount++;
+    }
+
+    return isOk(ip);
+}
+
+void
+DOSGuard::clear() noexcept
+{
+    std::scoped_lock const lck(mtx_);
+    ipState_.clear();
+}
+
+[[nodiscard]] std::unordered_set<std::string>
+DOSGuard::getWhitelist(util::Config const& config)
+{
+    using T = std::unordered_set<std::string> const;
+    auto whitelist = config.arrayOr("dos_guard.whitelist", {});
+    auto const transform = [](auto const& elem) { return elem.template value<std::string>(); };
+    return T{
+        boost::transform_iterator(std::begin(whitelist), transform),
+        boost::transform_iterator(std::end(whitelist), transform)
+    };
+}
+
+}  // namespace web::dosguard