Difference Between Revision 2 and Apache:Modules / apache2-mod_evasive
| [-] | Changed | apache2-mod_evasive.spec |
|
x 1 2 Source0: http://www.zdziarski.com/projects/mod_evasive/%{modname}_%{version}.tar.gz3 Source1: mod_evasive.conf4 Patch0: mod_evasive-void.patch5 +Patch1: apache24.patch6 BuildRoot: %{_tmppath}/%{name}-%{version}-build7 8 %description9 10 %prep11 %setup -n %{modname}12 %patch013 +%patch1 -p114 15 %build16 %{apxs} -a -c %{modname}20.c17 |
||
| [+] | Added | apache24.patch ^ |
| @@ -0,0 +1,83 @@ +--- mod_evasive/mod_evasive20.c.orig 2013-07-28 11:25:03.531367461 +0200 ++++ mod_evasive/mod_evasive20.c 2013-07-28 11:26:14.003148729 +0200 +@@ -139,11 +139,11 @@ + time_t t = time(NULL); + + /* Check whitelist */ +- if (is_whitelisted(r->connection->remote_ip)) ++ if (is_whitelisted(r->connection->client_ip)) + return OK; + + /* First see if the IP itself is on "hold" */ +- n = ntt_find(hit_list, r->connection->remote_ip); ++ n = ntt_find(hit_list, r->connection->client_ip); + + if (n != NULL && t-n->timestamp<blocking_period) { + +@@ -155,14 +155,14 @@ + } else { + + /* Has URI been hit too much? */ +- snprintf(hash_key, 2048, "%s_%s", r->connection->remote_ip, r->uri); ++ snprintf(hash_key, 2048, "%s_%s", r->connection->client_ip, r->uri); + n = ntt_find(hit_list, hash_key); + if (n != NULL) { + + /* If URI is being hit too much, add to "hold" list and 403 */ + if (t-n->timestamp<page_interval && n->count>=page_count) { + ret = HTTP_FORBIDDEN; +- ntt_insert(hit_list, r->connection->remote_ip, time(NULL)); ++ ntt_insert(hit_list, r->connection->client_ip, time(NULL)); + } else { + + /* Reset our hit count list as necessary */ +@@ -177,14 +177,14 @@ + } + + /* Has site been hit too much? */ +- snprintf(hash_key, 2048, "%s_SITE", r->connection->remote_ip); ++ snprintf(hash_key, 2048, "%s_SITE", r->connection->client_ip); + n = ntt_find(hit_list, hash_key); + if (n != NULL) { + + /* If site is being hit too much, add to "hold" list and 403 */ + if (t-n->timestamp<site_interval && n->count>=site_count) { + ret = HTTP_FORBIDDEN; +- ntt_insert(hit_list, r->connection->remote_ip, time(NULL)); ++ ntt_insert(hit_list, r->connection->client_ip, time(NULL)); + } else { + + /* Reset our hit count list as necessary */ +@@ -205,27 +205,27 @@ + struct stat s; + FILE *file; + +- snprintf(filename, sizeof(filename), "%s/dos-%s", log_dir != NULL ? log_dir : DEFAULT_LOG_DIR, r->connection->remote_ip); ++ snprintf(filename, sizeof(filename), "%s/dos-%s", log_dir != NULL ? log_dir : DEFAULT_LOG_DIR, r->connection->client_ip); + if (stat(filename, &s)) { + file = fopen(filename, "w"); + if (file != NULL) { + fprintf(file, "%ld\n", getpid()); + fclose(file); + +- LOG(LOG_ALERT, "Blacklisting address %s: possible DoS attack.", r->connection->remote_ip); ++ LOG(LOG_ALERT, "Blacklisting address %s: possible DoS attack.", r->connection->client_ip); + if (email_notify != NULL) { + snprintf(filename, sizeof(filename), MAILER, email_notify); + file = popen(filename, "w"); + if (file != NULL) { + fprintf(file, "To: %s\n", email_notify); +- fprintf(file, "Subject: HTTP BLACKLIST %s\n\n", r->connection->remote_ip); +- fprintf(file, "mod_evasive HTTP Blacklisted %s\n", r->connection->remote_ip); ++ fprintf(file, "Subject: HTTP BLACKLIST %s\n\n", r->connection->client_ip); ++ fprintf(file, "mod_evasive HTTP Blacklisted %s\n", r->connection->client_ip); + pclose(file); + } + } + + if (system_command != NULL) { +- snprintf(filename, sizeof(filename), system_command, r->connection->remote_ip); ++ snprintf(filename, sizeof(filename), system_command, r->connection->client_ip); + system(filename); + } + | ||