Implementing Anti-CC Attacks with OpenResty (nginx extension)

This article introduces the use of OpenResty to implement the functionality of preventing CC attacks. The official website of OpenResty is http://openresty.org/cn/index.html. Below is the flowchart for preventing CC attacks.
According to the flowchart, we know that preventing CC attacks mainly includes two parts: limiting request speed and sending users JS redirect code to verify the legitimacy of the request.

Installation Dependencies#

Centos:#

yum install readline-devel pcre-devel openssl-devel

Ubuntu:#

apt-get install libreadline-dev libncurses5-dev libpcre3-dev libssl-dev perl

Install LuaJIT

cd /tmp/
git clone http://luajit.org/git/luajit-2.0.git
cd luajit-2.0/
make && make install
ln -sf luajit-2.0.0-beta10 /usr/local/bin/luajit
ln -sf /usr/local/lib/libluajit-5.1.so.2 /usr/lib/

Install OpenResty#

cd /tmp
wget http://agentzh.org/misc/nginx/ngx_openresty-1.2.4.13.tar.gz
tar xzf ngx_openresty-1.2.4.13.tar.gz
cd ngx_openresty-1.2.4.13/
./configure --prefix=/usr/local/openresty --with-luajit
make && make install

Nginx Configuration#

nginx.conf:

    http{
    [......]
    lua_shared_dict limit 10m;
    lua_shared_dict jsjump 10m;
     
        server {
    #lua_code_cache off;
            listen       80;
            server_name  www.moeyy.cn;
     
            location / {
    default_type  text/html;
    content_by_lua_file "/usr/local/openresty/nginx/conf/lua";
            }
            location @cc {
                internal;
                root   html;
                index  index.html index.htm;
            }
        }
    }

/usr/local/openresty/nginx/conf/lua file:

    local ip = ngx.var.binary_remote_addr
    local limit = ngx.shared.limit
    local req,_=limit:get(ip)
    if req then
            if req > 20 then
                    ngx.exit(503)
            else
                    limit:incr(ip,1)
            end
    else
            limit:set(ip,1,10)
    end
     
    local jsjump = ngx.shared.jsjump
    local uri = ngx.var.request_uri
    local jspara,flags=jsjump:get(ip)
    local args = ngx.req.get_uri_args()
    if jspara then
        if flags then
            ngx.exec("@cc")
        else
                    local p_jskey=''
                    if args["moeyy_anticc"] and type(args["moeyy_anticc"])=='table' then
                             p_jskey=args["moeyy_anticc"][table.getn(args["moeyy_anticc"])]
                    else
                             p_jskey=args["moeyy_anticc"]
                    end
            if p_jskey and p_jskey==tostring(jspara) then
                            jsjump:set(ip,jspara,3600,1)
                            ngx.exec("@cc")
            else
                            local url=''
                            if ngx.var.args then
                                   url=ngx.var.scheme.."://"..ngx.var.host..uri.."&moeyy_anticc="..jspara
                            else
                                   url=ngx.var.scheme.."://"..ngx.var.host..uri.."?moeyy_anticc="..jspara
                            end
                            local jscode="window.location.href='"..url.."';"
                            ngx.say(jscode)
            end
        end
    else
    math.randomseed( os.time() );
        local random=math.random(100000,999999)
        jsjump:set(ip,random,60)
        local url=''
        if ngx.var.args then
            url=ngx.var.scheme.."://"..ngx.var.host..uri.."&moeyy_anticc="..random
        else
            url=ngx.var.scheme.."://"..ngx.var.host..uri.."?moeyy_anticc="..random
        end
        local jscode="window.location.href='"..url.."';"
        ngx.say(jscode)
    end

**Explanation of the Lua code section:

Lines 1-12 implement the rate limiting feature, where line 5 and line 10 indicate that only 20 requests can be made within 10 seconds.
Lines 14-48 are the verification part, where line 24 with 3600 indicates that after verification, the whitelist time is 3600 seconds, which is 1 hour.**