Maybe the native D6 function flood_is_allowed($name, $threshold) might be an option. Usage as in the default contact module (contact.pages.inc):

function contact_site_page() {
  global $user;

  if (!flood_is_allowed('contact', variable_get('contact_hourly_threshold', 3))) {
    $output = t("You cannot send more than %number messages per hour. Please try again later.", array('%number' => variable_get('contact_hourly_threshold', 3)));
  }
  else {
    $output = drupal_get_form('contact_mail_page');
  }

  return $output;
}

Comments

zzolo’s picture

zzolo commented
Version: » 6.x-1.x-dev

Also this function is needed: http://api.drupal.org/api/function/flood_register_event/6

Interesting, I have never noticed these API functions before. It's a pretty simple mechanism. I think this may be a good fail safe. Something like a limit of 3600/hour just to make sure that abuse can only go so high.

Using this as more of an indicator might be good. Something similar to what Twitter used to do (from what I understand) of only allowing a request every minute or something like this. But, this is more why the cache exists. If someone wants to attack your site, that sucks, but the proxy allows it to happen to a different site, through your site.

So, how about this. The default (though configurable) is to flag or ban the IP if they make more than 3600/requests per hour. I think this, with a whitelist system could be considered secure (not that this is a real security issue, more of an abuse possibility)

I am also concerned a little about the DB write for every request. Seems ok for a contact form, but for a proxy, seems like it could be a little much. We are already doing DB operations with the cache.

(sorry, lots of rambling)

japanitrat’s picture

japanitrat commented

I wonder how you would solve the issue without the aid of recording a users' (or bots') actions. AFAIK there is no real security against such kind of attack. Maybe there should also be a treshold for target-destinations (regardless of the "user" host).

This is really a critical point in a proxy at all.

zzolo’s picture

zzolo commented
Status: Active » Needs review

Added flood control:
http://drupal.org/cvs?commit=317060

This commit also provides a whitelist functionality. Meaning that the proxy won't work without adding domains to it. It can be turned off.

It might be best to add another feature which limits request globally. This would be harder to manage. If your site got a big spike in usage, it would bring the proxy to a halt.

One question for this particular issues is: Should Proxy automatically ban any user that goes over the flood threshold? As it stand, the user can continually use the threshold every hour.

japanitrat’s picture

japanitrat commented

you're right, it pretty much depends on the usage-load of the site. Maybe this is only useful for anonymous users. Regarding the auto-ban .. hmm, i don't know. It may be a bit harsh, since it requires an administrator/maintainer to unban the user manually. Placing some kind of "beware-this-bad-user"-message with a counter for maintainers might be useful, though. But I am not quite sure if this good in a worst-case either.

zzolo’s picture

zzolo commented
Status: Needs review » Fixed

http://drupal.org/cvs?commit=317850

Added auto-ban feature. Yes, you can auto-ban yourself. But, no, it is not turned on by default. It is just a measure fore someone that has a fairly open site to create a way of containing any possible attacks to a threshold.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.