When a new request is received from an IP in the <B>probationB> state, the IP enters the <B>throttledB> state and is assigned a delay property initially equal to initial_delay. Connection to a backend is postponed for delay seconds while perlbal continues to work. If the connection is still open after the delay, the request is then handled normally. A dropped connection does not change the IPs delay value.
When a new request is received from an IP in the <B>throttledB> state, its violations property is incremented, and its delay property is doubled (up to a maximum of max_delay). The request is postponed for the new value of delay.
IPs in the <B>throttledB> state may have no more than max_concurrent connections being delayed at once. Any additional requests received in that circumstance are sent a 503 Too many connections response. Long-running requests which have already been connected to a backend do not count towards this limit.
New connections from IPs in the banned state are immediately closed with a 403 error response.
o IP whitelist
Connections from IPs/CIDRs listed in the file specified by whitelist_file are always allowed.
o IP blacklist
Connections from IPs/CIDRs listed in the file specified by blacklist_file immediately sent a 403 Forbidden response.
o Flexible attack response
For services where throttling should not normally be enabled, use the default_action tunable. When default_action is set to allow, new connections from non-white/blacklisted IPs will not be throttled.
Furthermore, if throttling should only apply to specific clients, set blacklist_action to throttle. Blacklisted connections will then be throttled instead of denied.
o Dynamic configuration
Most service tunables may be updated from the management port, after which the new values will be respected (although see CAVEATS). To reload the whitelist and blacklist files, issue the throttle reload whitelist or throttle reload blacklist command to the service.
o Path specificity
Throttling may be restricted to URI paths matching the path_regex regex.
o External shared state
The plugin stores state which IPs have been seen in a memcached(1) instance. This allows many throttlers to share their state and also minimizes memory use within the perlbal. If state exceeds the capacity of the memcacheds, the least-recently seen IPs will be forgotten, effectively resetting them to the <B>allowedB> state.
Orthogonally, multiple throttlers which need to share memcacheds but not state may specify distinct instance_name values.
If Perlbal::Plugin::Syslogger is installed and registered with the service, Throttle can use it to send syslog messages regarding actions that are taken. Granular control for which events are logged is available via the log_events parameter. log_events is composed of one or more of the following events, separated by commas:
Log when a temporary local ban is added for an IP address.
Log when a temporary local ban is removed for an IP address.
Log when a request is allowed because the source IP is on the whitelist.
Log when a request is denied or throttled because the source IP is on the blacklist.
Log when a request is denied because the source IP is on the temporary ban list for connecting excessively.
Log when a request is denied because the source IP has too many open connections waiting to be unthrottled.
Log when a request is throttled because the source IP was not on the whitelist or blacklist.
Enables all the above logging options.
Disables all the above logging options.
o Dynamic configuration changes
Changes to certain other tunables will not be respected after the plugin has been registered. These include memcached_servers and memcached_async_clients.
o List loading is blocking
The throttle reload whitelist and throttle reload blacklist management commands load the whitelist and blacklist files synchronously, which will cause the perlbal to hang until it completes.
If a handled request returns a 30x response code and the redirect URI is also throttled, then the clients attempt to follow the redirect will necessarily be delayed by initial_delay. Fixing this would require that the plugin inspect the HTTP response headers, which would incur a lot of overhead. To workaround, try to have your backend not return 30xs if both the original and redirect URI are proxied by the same throttler instance (yes, this is difficult for the case where a backend 302s to add a trailing / to a directory).
Required for memcached support. This is the supported way to share state between different perlbal instances.
Required for blacklist/whitelist support.
Required for event logging support.
o List of tunables in Throttle.pm.
o Fix white/blacklist loading
Load CIDR lists asynchronously (perhaps in the manner of Perlbal::Pool::_load_nodefile_async).
Adam Thomason, <firstname.lastname@example.org>
Copyright (C) 2007-2011 by Say Media Inc, <email@example.com>
This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.6 or, at your option, any later version of Perl 5 you may have available.
|perl v5.20.3||PERLBAL::PLUGIN::THROTTLE (3)||2012-02-01|