java socket ddos_记一次解决非法参数DDoS攻击的实践

起因

线上项目突然遭到大量的非法参数攻击，由于历史问题，之前的代码从未对请求参数进行校验。

导致大量请求落到了数据访问层，给应用服务器和数据库都带来了很大压力。

针对这个问题，只能对请求真正到Controller方法调用之前直接将非法参数请求拒绝掉，所以在Filter中对参数进行统一校验，非法参数直接返回400。

定义参数检查规则：

先检查uri是否需要拦截

再检查请求参数是否合法：对于请求参数的检查，如果有值，不能存在非法值

最后检查cookie是否正确：检查必须存在的cookie参数

代码示例

package com.lenovo.moc.portal.filter;

import java.io.IOException;

import java.util.ArrayList;

import java.util.Enumeration;

import java.util.HashMap;

import java.util.List;

import java.util.Map;

import java.util.regex.Matcher;

import java.util.regex.Pattern;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.Cookie;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import com.lenovo.moc.portal.util.SessionUtil;

import com.lenovo.moc.portal.util.WebUtil;

/**

* 检查请求参数过滤器

* 从2方面验证请求参数的有效性：检查cookie和请求参数

* @date 2017年8月9日

*/

public class CheckRequestParamFilter implements Filter {

private static final Logger logger = LoggerFactory.getLogger(CheckRequestParamFilter.class);

private static final List anonUriList = new ArrayList(); // 不需要进行参数和cookie检查额uri列表

{

anonUriList.add("/home.do");

anonUriList.add("/home_login_callback.do");

anonUriList.add("/home_login_demo.do");

anonUriList.add("/home_logout.do");

anonUriList.add("/home_admin_logout.do");

}

public void init(FilterConfig filterConfig) throws ServletException {

if(logger.isDebugEnabled()) {

logger.debug("CheckRequestParamFilter init");

}

}

// 参数和cookie检查

// 1. 先检查uri是否需要拦截

// 2. 再检查请求参数是否合法

// 3. 最后检查cookie是否正确

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)

throws IOException, ServletException {

HttpServletRequest req = (HttpServletRequest)request;

HttpServletResponse resp = (HttpServletResponse)response;

String uri = req.getRequestURI();

if(checkUri(req, resp, uri)) {

chain.doFilter(request, response);

return;

}

if(!checkParams(req, resp, uri)) {

return;

}

if(!checkCookie(req, resp, uri)) {

return;

}

chain.doFilter(request, response);

}

/**

* 检查uri是否需要检查参数

* @param req

* @param resp

* @param uri

* @return 不需要检查,返回true; 否则返回false.

*/

private boolean checkUri(HttpServletRequest req, HttpServletResponse resp, String uri) {

if(logger.isDebugEnabled()) {

logger.debug("request uri: {}", uri.trim());

}

uri = uri.substring(req.getContextPath().length());

return anonUriList.contains(uri.trim());

}

/**

* 请求参数如果不为空，则不能包含特殊字符

* @param req

* @param resp

* @param uri

* @return

*/

private boolean checkParams(HttpServletRequest req, HttpServletResponse resp, String uri) {

Enumeration> enumeration = req.getParameterNames();

while(enumeration.hasMoreElements()) {

String key = enumeration.nextElement().toString();

Object value = req.getParameter(key);

if(value == null || "".equals(value.toString().trim())) {

continue;

}

if(containsInvalidChars(value.toString())) {

logger.error("request param value contains invalid chars! param name: {}, param value: {}, uri: {}", key, value, uri);

return false;

}

if(containsInvalidString(value.toString())) {

logger.error("request param value contains invalid string! parma name: {}, param value: {}, uri: {}", key, value, uri);

return false;

}

}

if(logger.isDebugEnabled()) {

logger.debug("check all request parameters are valid, uri: {}", uri);

}

return true;

}

/**

* 检查是否包含特殊字符

* @param value

* @return

*/

private static boolean containsInvalidChars(String value) {

String regex = "[`~!#$%^&()|{}';'\\[\\]<>?~！#￥%……&()——|{}【】‘；：”“’。，、？]";

Pattern pattern = Pattern.compile(regex);

Matcher matcher = pattern.matcher(value);

return matcher.find();

}

/**

* 检查是否包含特殊字符串

* @param value

* @return

*/

private static boolean containsInvalidString(String value) {

return value.contains("select") ||

value.contains("nslookup") ||

value.contains("sleep");

}

/**

* 指定cookie必须存在

* @param req

* @param resp

* @param uri

* @return

* @throws IOException

*/

private boolean checkCookie(HttpServletRequest req, HttpServletResponse resp, String uri) throws IOException {

Map cookieMap = new HashMap();

Cookie[] cookies = req.getCookies();

for(Cookie c : cookies) {

cookieMap.put(c.getName(), c.getValue());

}

// 检查SessionUtil.LOGIN_STAFF_ID

String loginStaffId = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_STAFF_ID));

if(loginStaffId == null) {

logger.error("login staff id cookie NOT FOUND! uri: {}", uri);

deny(req, resp, "invalid param");

return false;

}

// 检查SessionUtil.LOGIN_COMPANY_ID

String loginCompanyId = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_COMPANY_ID));

if(loginCompanyId == null) {

logger.error("login company id cookie NOT FOUND! uri: {}", uri);

deny(req, resp, "invalid param");

return false;

}

// 检查SessionUtil.LOGIN_COMPANY_NAME

String loginCompanyName = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_COMPANY_NAME));

if(loginCompanyName == null) {

logger.error("login company name cookie NOT FOUND! uri: {}", uri);

deny(req, resp, "invalid param");

return false;

}

// 检查SessionUtil.LOGIN_USER_NAME

String loginUserName = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_USER_NAME));

if(loginUserName == null) {

logger.error("login user name cookie NOT FOUND! uri: {}", uri);

deny(req, resp, "invalid param");

return false;

}

// 检查SessionUtil.LOGIN_USER_ACCOUNT

String loginUserAccount = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_USER_ACCOUNT));

if(loginUserAccount == null) {

logger.error("login user account cookie NOT FOUND! uri: {}", uri);

deny(req, resp, "invalid param");

return false;

}

// 检查SessionUtil.LOGIN_USER_ROLE

String loginUserRole = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_USER_ROLE));

if(loginUserRole == null) {

logger.error("login user role cookie NOT FOUND! uri: {}", uri);

deny(req, resp, "invalid param");

return false;

}

// 检查SessionUtil.LOGIN_USER_ROLE_CODE

String loginUserCode = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_USER_ROLE_CODE));

if(loginUserCode == null) {

logger.error("login user role code cookie NOT FOUND! uri: {}", uri);

deny(req, resp, "invalid param");

return false;

}

if(logger.isDebugEnabled()) {

logger.debug("check all cookies are valid, uri: {}", uri);

}

return true;

}

/**

* 断开与客户端的连接

* @param req

* @param resp

* @param message

* @throws IOException

*/

private void deny(HttpServletRequest req, HttpServletResponse resp, String message) throws IOException {

resp.setStatus(HttpServletResponse.SC_BAD_REQUEST);

resp.getWriter().write(message);

resp.getWriter().close();

}

public void destroy() {

}

}