Link
Embed
Share
Beginning
This slide
Copy link URL
Copy link URL
Copy iframe embed code
Copy iframe embed code
Copy javascript embed code
Copy javascript embed code
Share
Tweet
Share
Tweet
Slide 1
Slide 1 text
ٱถഅ(.01FQBCP *OD भΠϯϑϥަྲྀษڧձ,*94WPM!(.0ϖύϘԬࢧࣾ ϗεςΟϯάʹ͓͚Δॊೈ͔ͭܰྔͳΞΫηε੍ޚͷ ඞཁੑͱͦͷ࣮
Slide 2
Slide 2 text
ࣗݾհ ٱถ അ (@takumakume) ߴߍଔۀʙ6ؒ ΠϯλʔωοταʔϏεϓϩόΠμͰۈ ωοτϫʔΫʙϛυϧΣΞͷߏங ϓϦηʔϧεΤϯδχΞ 20164݄͔ΒϖύϘʹೖࣾ ϩϦϙοϓʂͷΠϯϑϥΤϯδχΞ
Slide 3
Slide 3 text
࣍ ϗεςΟϯάʹ͓͚Δॊೈ͔ͭܰྔͳΞΫηε੍ޚͱ mrubyΛ༻͍ͨ࣍ੈΞΫηε੍ޚͷ࣮ ·ͱΊ
Slide 4
Slide 4 text
ϗεςΟϯάʹ͓͚Δॊೈ͔ͭܰྔͳΞΫηε੍ޚ ͱ
Slide 5
Slide 5 text
ॊೈ͔ͭܰྔͳΞΫηε੍ޚ
Slide 6
Slide 6 text
ϗεςΟϯάʹ͓͚ΔΞΫηε੍ޚ ϗεςΟϯάͦͷಛੑ্ɺ͓٬༷ͷ༷ʑͳίϯςϯπΛ͓ ༬͔Γ͍ͯ͠Δɻ தʹҟৗʹߴෛՙʹͳΔͷɺDDoSͷରʹͳΔίϯς ϯπͳͲ༷ʑͰ͋Δɻ ͔͠͠ɺ͜ͷΑ͏ͳҰ෦ͷίϯςϯπʹΑΓɺͦͷαʔόΛ ͝ར༻͍͍ͯΔେଟͷଞͷ͓٬༷͕շదʹ8Λར༻Ͱ͖ͳ͘ ͳͬͯ͠·͏͜ͱɺ͋ͬͯͳΒͳ͍ͱզʑߟ͍͑ͯ·͢ɻ
Slide 7
Slide 7 text
ຊηογϣϯͰͦͷղܾखஈͷ̍ͭͱͯ͠ɺ ϩϦϙοϓʂͰߦ͍ͬͯΔ ଟ͘ͷ͓٬༷ʹ8Λշదʹ͝ར༻͍ͨͩͨ͘Ίͷ ࣍ੈΞΫηε੍ޚʹ͍ͭͯ͝հ͠·͢ɻ
Slide 8
Slide 8 text
ॊೈ͔ͭܰྔͳΞΫηε੍ޚ
Slide 9
Slide 9 text
ݱঢ়ͷΞΫηε੍ޚͷ՝
Slide 10
Slide 10 text
͜Ε·Ͱʹར༻ͨ͠ΞΫηε੍ޚखஈ mod_cbandΛར༻ͨ͠ΞΧϯτ୯ҐͰͷτϥϑΟοΫ ੍ޚͱಉ࣌ΞΫηε੍ޚ mod_vhost_maxclientsΛར༻ͨ͠υϝΠϯ୯ҐͰͷ ಉ࣌ΞΫηε੍ޚ ͦΕͧΕ՝͕͋ͬͨ
Slide 11
Slide 11 text
NPE@DCBOEΛར༻੍ͨ͠ޚʹΑΔ՝ ΞΧϯτ୯ҐͷτϥϑΟοΫͱಉ࣌ΞΫηε੍ݶΛ͍ͯͨ͠ɻ CBandSpeed 10Mb/s 30 30 mod_cbandΛ༗ޮʹ͢Δ͜ͱͰ70%ఔͷύϑΥʔϚϯε ྼԽ͕ੜ͡ɺ੍ޚػߏࣗମ͕ϘτϧωοΫͱͳͬͨɻ
Slide 12
Slide 12 text
NPE@WIPTU@NBYDMJFOUTΛར༻੍ͨ͠ޚ mod_cbandͷύϑΥʔϚϯεྼԽ͕େ͖͍ͨΊͪ͜ΒΛ࠾༻ɻ ಋೖʹΑΔύϑΥʔϚϯεྼԽ2%ͱߴͳιϑτΣΞɻ ҎԼͷΑ͏ʹυϝΠϯ୯Ґͷಉ࣌ΞΫηε੍ݶΛߦ͏ɻ DocumentRoot /path/to/web ServerName hoge.example.jp VhostMaxClients 30 ͔͠͠ɺ࣍ͷΑ͏ͳύλʔϯͰ՝͕ੜͨ͡ɻ
Slide 13
Slide 13 text
NPE@WIPTU@NBYDMJFOUTΛͲ͏͍ͬͯΔ͔ ڞ༻8αʔό IPHFDPN mod_vhost_maxclientsͷ੍ݶ ZDPN YDPN ஶ͘͠Ϧιʔε༻ྔ͕ภΒͳ͍Α͏ʹେͷϦιʔεׂͱ ͯ͠ɺ֤υϝΠϯʹಉ࣌ଓͷ੍ݶΛ͔͚͍ͯ·͢ɻ
Slide 14
Slide 14 text
ڞ༻8αʔό IPHFDPN ॲཧͷॏ͍ϓϩάϥϜʹΞΫηε͕ूத͠αʔό͕ߴෛՙͱͳͬͨ mod_vhost_maxclientsͷ੍ݶ ZDPN YDPN
Slide 15
Slide 15 text
ڞ༻8αʔό IPHFDPN mod_vhost_maxclientsͷ੍ݶ ZDPN YDPN NPE@WIPTU@NBYDMJFOUTͷ੍ݶΛڧΊΔඞཁ͕͋Δ
Slide 16
Slide 16 text
ڞ༻8αʔό IPHFDPN ZDPN YDPN ੍ݶΛڧΊͨ ܰྔͳίϯςϯπʹΞΫηεͰ͖ͳ͘ͳΔ
Slide 17
Slide 17 text
ڞ༻8αʔό IPHFDPN ZDPN YDPN ຊདྷ੍ޚ͞ΕΔඞཁ͕ͳ͍ϑΝΠϧ·Ͱ ΞΫηεͰ͖ͳ͘ͳͬͯ͠·͏ɻ
Slide 18
Slide 18 text
ղܾํ๏ ڞ༻8αʔό IPHFDPN ZDPN YDPN ϑΝΠϧ୯ҐͰ੍ޚ mod_vhost_maxclients
Slide 19
Slide 19 text
ղܾํ๏ ڞ༻8αʔό IPHFDPN ZDPN YDPN ϑΝΠϧ୯ҐͰ੍ޚ mod_vhost_maxclients αʔόͷෛՙΛԼ͛ͭͭɺ੍ޚʹΑΔӨڹΛۃখԽͰ͖Δɻ
Slide 20
Slide 20 text
࣌ ࣌ ࣌ ࣌ ࣌ ࣌ ࣌ ࣌ ࣌ ͋ΔαʔόͷϦιʔεফඅྔ <>
Slide 21
Slide 21 text
࣌ ࣌ ࣌ ࣌ ࣌ ࣌ ࣌ ࣌ ࣌ શମ ͋ΔαʔόͷϦιʔεফඅྔ <> ಛఆͷϑΝΠϧ ಛఆͷ࣌ؒʹେྔʹΞΫηε͕͋Δ
Slide 22
Slide 22 text
࣌ ࣌ ࣌ ࣌ ࣌ ࣌ ࣌ ࣌ ࣌ શମ ͋ΔαʔόͷϦιʔεফඅྔ <> ಛఆͷϑΝΠϧ ಛఆͷϑΝΠϧͷॲཧͰϦιʔεͷ΄ͱΜͲΛফඅ͠ ఆظతʹଞͷ͓٬༷ͷαʔϏεఏڙʹࢧোΛ͖͍ͨͯͨ͠ɻ
Slide 23
Slide 23 text
࣌ ࣌ ࣌ ࣌ ࣌ ࣌ ࣌ ࣌ ࣌ શମ ಛఆͷϑΝΠϧ ղܾํ๏ <> ෛՙͷߴ͍ϑΝΠϧʹରͯ͠ ࣌ؒࢦఆͰ੍ޚ͢Δ
Slide 24
Slide 24 text
ॊೈͳΞΫηε੍ޚͷ·ͱΊ ݱঢ়ΑΓࡉ͔͍ɺϑΝΠϧ୯ҐͰΞΫηε੍ޚͰ͖ΔΑ͏ ʹͯ͠ɺ੍ޚʹΑΔӨڹΛۃখԽ͢Δ͜ͱɻ ಛఆͷ࣌ؒͷΈΞΫηε੍ޚΛ༗ޮԽͰ͖Δ͜ͱɻ
Slide 25
Slide 25 text
ॊೈ͔ͭܰྔͳΞΫηε੍ޚ
Slide 26
Slide 26 text
ϗεςΟϯάͰ1ͷαʔόΛଟ͘ͷ͓٬༷ʹ͝ར༻͍ͨͩ͘͜ ͱͰ҆Ձʹఏڙ͍ͯ͠Δɻ ࠓޙͰ͖Δ͚ͩ҆ՁʹշదͳαʔϏεΛఏڙ͍ͨ͠ɻ ΞΫηε੍ޚͷػߏ͕ϘτϧωοΫʹͳͬͯɺͦΕΛୡͰ͖ ͳ͘ͳΔɻ ܰྔͳΞΫηε੍ޚͷඞཁੑ
Slide 27
Slide 27 text
ॊೈ͔ͭܰྔͳΞΫηε੍ޚ ͱ
Slide 28
Slide 28 text
ϑΝΠϧ୯ҐͰΞΫηε੍ޚͰ͖Δ͜ͱɻ ಛఆͷ࣌ؒଳͷΈΞΫηε੍ޚΛ༗ޮԽͰ͖Δ͜ͱɻ ύϑΥʔϚϯεྼԽΛۃྗى͜͞ͳ͍͜ͱɻ ॊೈ͔ͭܰྔͳΞΫηε੍ޚͱ ͲͷΑ͏ʹ࣮ݱ͢Δ͔ʁ
Slide 29
Slide 29 text
ϑΝΠϧ୯ҐͷΞΫηε੍ޚ طʹ"QBDIFͷϞδϡʔϧ͕ଘࡏ͢Δɻ
Slide 30
Slide 30 text
NPE@WMJNJU mod_vlimit https://github.com/matsumoto-r/mod_vlimit ϑΝΠϧσΟϨΫτϦ୯ҐͰಉ࣌ΞΫηε੍ޚΛ͢Δ͜ͱ͕Ͱ͖Δɻ VlimitIP 30 /path/to/hoge.php ϑΝΠϧ୯ҐͰͷΞΫηε੍ޚΛߦ͏ػೳ͋Δ͕ ࠓճಋೖʹࢸΒͳ͔ͬͨɻ
Slide 31
Slide 31 text
NPE@WMJNJUΛ࠾༻͠ͳ͔ͬͨཧ༝ ࣌ؒࢦఆͰ੍ݶΛ༗ޮԽͰ͖Δػೳ͕ͳ͍ɻ ApacheͷϞδϡʔϧͳͷͰCݴޠͰ࣮͞Ε͍ͯΔɻ ӡ༻ܥͷπʔϧ࣌ؒͷܦաʹରͯ͠ॊೈͳมߋ͕ཁ ٻ͞ΕΔɻ CݴޠͰͷ։ൃͱͳΔͱ։ൃ্͕͕Δɺ։ൃऀ͕ݶ ΒΕΔɻ
Slide 32
Slide 32 text
ͰɺͲͷΑ͏ʹ࣮ݱ͢Δ͔ʁ
Slide 33
Slide 33 text
“mruby” ͳΒղܾͰ͖Δɻ
Slide 34
Slide 34 text
NSVCZ Rubyͷύύ͜ͱ “Matz” ͞Μ͕։ൃ͍ͯ͠Δɻ লϝϞϦͷΈࠐΈ͚ͷRuby࣮ɻ Cݴޠ͕ۤखͳͻͱͰɺmrubyΛ͑RubyͰΈࠐΈ ։ൃΛߦ͏ࣄ͕Ͱ͖Δɻ
Slide 35
Slide 35 text
ApacheNginxͰmrubyΛ༻͍ͨΈࠐΈ ։ൃΛ࣮ݱͨ͠ιϑτΣΞ͕ଘࡏ͢Δ
Slide 36
Slide 36 text
NPE@NSVCZOHY@NSVCZ ฐࣾͷ@matsumotory͕։ൃ͍ͯ͠Δɻ mod_mruby ApacheͰmrubyΛར༻͢ΔͨΊͷϞδϡʔϧ ngx_mruby nginxͰmrubyΛར༻͢ΔͨΊͷ֦ு࣮ CݴޠͰϞδϡʔϧΛ࣮͠ͳ͚Ε࣮ݱͰ͖ͳ͔ͬͨڍಈΛmruby Λ͙ͬͯ͢ʹ࣮Ͱ͖ͯɺ࠷খݶͷύϑΥʔϚϯεྼԽʹཹΊΔ͜ ͱ͕Ͱ͖ΔιϑτΣΞɻ
Slide 37
Slide 37 text
IUUQTHJUIVCDPNNBUTVNPUPSNPE@NSVCZ mod_mruby -1.5% ngx_mruby +17.5% ੩తίϯςϯπʹର͢ΔύϑΥʔϚϯεܭଌ݁Ռ
Slide 38
Slide 38 text
mrubyΛ༻͍Ε֦ுੑɺอकੑΛଛͳΘͣ ࠷খݶͷύϑΥʔϚϯεྼԽʹཹΊͯ ιϑτΣΞΛ։ൃ͢Δ͜ͱ͕Ͱ͖Δɻ
Slide 39
Slide 39 text
NSVCZΛ༻͍ͨ࣍ੈΞΫηε੍ޚͷ࣮
Slide 40
Slide 40 text
࣮ʹ͋ͨͬͯར༻ͨ͠ιϑτΣΞ
Slide 41
Slide 41 text
IUUQBDDFTTMJNJUFS ฐࣾͷ @matsumotory ͕։ൃ͍ͯ͠Δɻ https://github.com/matsumoto-r/http-access-limiter mod_mruby͘͠ngx_mrubyͰऔಘͨ͠ҙͷϦΫΤετύϥ ϝʔλΛ༻͍ͯಉ࣌ଓΛΧϯτ͢ΔmrubyϛυϧΣΞ औಘͰ͖ΔϦΫΤετύϥϝʔλʹΞΫηεઌͷϑΝΠϧͷϑϧ ύεΛ࢝ΊɺଓݩͷIPΞυϨεɺURLͳͲΛऔಘͰ͖ΔͨΊ ༷ʑͳ༻్Ͱ༻Ͱ͖Δɻ
Slide 42
Slide 42 text
ಈ࡞֓ཁ NSVCZ 8PSLFS NSVCZ 8PSLFS NSVCZ IUUQE ڞ༗ϝϞϦ global mutex ಉ࣌ଓ Χϯλʔ KVS ಉ࣌ଓΧϯλʔ localmemcacheΛ༻͍ͨ Key-Value-Store Ωʔͱͨ͠ϦΫΤετύϥϝʔ λΛݩʹಉ࣌ΞΫηεΛΧ ϯτ͢Δɻ global mutex ֤Worker͔Βಉ࣌ଓΧ ϯλʔΛૢ࡞͢ΔͨΊෆ ߹͕ൃੜ͠ͳ͍Α͏ʹϩο ΫΛߦ͏ɻ KEY /path/to/hoge.php VALUE 1
Slide 43
Slide 43 text
ಈ࡞֓ཁ NSVCZ 8PSLFS NSVCZ 8PSLFS NSVCZ IUUQE ڞ༗ϝϞϦ global mutex ಉ࣌ଓ Χϯλʔ KVS ϦΫΤετ ϦΫΤετ NVUFYΛϩοΫ MPDL ϦΫΤετύϥϝʔλΛΩʔ ʹΠϯΫϦϝϯτ ΠϯΫϦϝϯτ KEY /path/to/hoge.php VALUE 1 VOMPDL NVUFYΛΞϯϩοΫ
Slide 44
Slide 44 text
ಈ࡞֓ཁ NSVCZ 8PSLFS NSVCZ 8PSLFS NSVCZ IUUQE ڞ༗ϝϞϦ global mutex ಉ࣌ଓ Χϯλʔ KVS ίϯςϯπͷॲཧΛߦ͏ NVUFYΛϩοΫ MPDL σΫϦϝϯτ σΫϦϝϯτ VOMPDL NVUFYΛΞϯϩοΫ KEY /path/to/hoge.php VALUE 0 ίϯςϯπͷॲཧ
Slide 45
Slide 45 text
ಈ࡞֓ཁͷ·ͱΊ ϦΫΤετ͕͋ͬͨ࣌ʹɺϦΫΤετύϥϝʔλΛmod_mruby ngx_mrubyΛ༻͍ͯऔಘ͢Δɻ ΞΫηε੍ޚΛ͍ͨ͠୯ҐΛΩʔͱͯ͠ɺಉ࣌ଓΛΧϯτ͢Δɻ ෳͷWorker͔ΒΧϯλʔૢ࡞͢ΔͨΊɺglobal mutexΛͬͯ ෆ߹͕ى͖ͳ͍Α͏ʹ੍ޚ͢Δɻ
Slide 46
Slide 46 text
ػೳՃΛ͢Δ http-access-limiterʹϑΝΠϧຖͷ࠷େಉ࣌ଓͷઃఆ ػೳɺ੍ޚΛ༗ޮԽ͢Δ࣌ؒଳΛઃఆ͢ΔػೳΛՃͨ͠ ͍ɻ mrubyͰॻ͔Ε͍ͯΔͨΊ؆୯ʹػೳՃ͕Ͱ͖Δʂ
Slide 47
Slide 47 text
ػೳՃΠϝʔδ NSVCZ 8PSLFS NSVCZ 8PSLFS NSVCZ IUUQE ڞ༗ϝϞϦ global mutex ಉ࣌ଓ Χϯλʔ KVS ੍ޚ݅ localmemcacheΛ༻͍ͨ Key-Value-Store ϑΝΠϧͷϑϧύε͕Ωʔ ࠷େಉ࣌ଓ ੍ݶΛ༗ޮԽ͢Δ࣌ؒଳ KVS ੍ޚ݅
Slide 48
Slide 48 text
੍ݶ݅ͷσʔλ /path/to/hoge.php { "max_clients" : 30, # ࠷େಉ࣌ଓ "time_slots" : [ # ༗ޮʹ͢Δ࣌ؒଳ { "begin" : 1200, "end" : 1800 }, { "begin" : 2100, "end" : 2200 } ] } KEY VALUE A AͷؒAQBUIUPIPHFQIQAͷ ࠷େଓΛAA·Ͱʹ੍ݶ͢Δɻ
Slide 49
Slide 49 text
ػೳՃޙͷಈ࡞֓ཁ NSVCZ 8PSLFS NSVCZ 8PSLFS NSVCZ IUUQE ڞ༗ϝϞϦ global mutex ಉ࣌ଓ Χϯλʔ KVS KVS ੍ޚ݅ ϦΫΤετ ϦΫΤετ ੍ޚ݅ Λࢀর ੍ޚ݅Λࢀর ɹɹଘࡏ͠ͳ͚Εॲཧऴྃ NVUFYΛϩοΫ MPDL ϑΝΠϧͷϑϧύεΛΩʔʹ ΠϯΫϦϝϯτ ΠϯΫϦϝϯτ ੍͠ݶ͕༗ޮͳ࣌ؒଳͰಉ ࣌ଓ੍ݶΛա͍ͯ͠Ε ΤϥʔΛฦ͢
Slide 50
Slide 50 text
͍ํ IUUQEDPOG LoadModule mruby_module modules/mod_mruby.so # Apacheͷϓϩηε͕ىಈͨ࣌͠ʹϑοΫ͞ΕΔ # http-access-limiterͷΫϥεΛఆٛɺ࣍ʹىಈ͢ΔWorker͕ࢀরͰ͖ΔΑ͏ʹ͢Δɻ mrubyPostConfigMiddle /etc/httpd/conf.d/access_limiter/access_limiter_init.rb cache # ΞΫηε͕ൃੜͨ͠ͱ͖ʹϑοΫ͞ΕΔ # ಉ࣌ଓΧϯλΛΠϯΫϦϝϯτ͢Δ # ͞Βʹɺ࠷େಉ࣌ଓΛաͨ͠߹ʹ503ΤϥʔΛฦ͢ͳͲͷΞΫγϣϯΛهड़͢Δɻ mrubyAccessCheckerMiddle /etc/httpd/conf.d/access_limiter/access_limiter.rb cache # ίϯςϯπͷॲཧ͕ऴΘͬͨͱ͖ʹϑοΫ͞ΕΔ # ಉ࣌ଓΧϯλΛσΫϦϝϯτ͢Δ mrubyLogTransactionMiddle /etc/httpd/conf.d/access_limiter/access_limiter_end.rb cache
Slide 51
Slide 51 text
ؾʹͳΔύϑΥʔϚϯε
Slide 52
Slide 52 text
ಋೖʹΑΔύϑΥʔϚϯεྼԽ 3ˋ
Slide 53
Slide 53 text
ύϑΥʔϚϯεςετ݁Ռ abΛͬͯύϑΥʔϚϯεΛଌఆ͠·ͨ͠ɻ ςετύλʔϯ ྼԽ httpd 0% httpd + http-access-limiter 3% httpd + http-access-limiter (੍ݶର) 5% WordPressͷΞΫηε 10ສϦΫΤετ100ଟॏ / CPU24ίΞɾRAM32GB ςετύλʔϯ ྼԽ httpd 0% httpd + http-access-limiter 3% httpd + http-access-limiter (੍ݶର) 30% phpinfo()ͷΞΫηε ࢀߟࢿྉ
Slide 54
Slide 54 text
ύϑΥʔϚϯεςετ݁Ռʹର͢Δߟ access-limiterͷಋೖʹੜ͡ΔύϑΥʔϚϯεྼԽ3%ͱߴ Ͱ͋Δ͜ͱ͕͔ͬͨɻ DBΛ͏WordPressͰɺΞϓϦέʔγϣϯͷॲཧ͕Φʔό ϔουͱͳͬͯaccess-limiterΛಋೖ͢Δ͜ͱʹΑΔΦʔό ϔουޡࠩఔͱͳͬͨɻ phpinfo()ͷΑ͏ͳܰྔͳॲཧͷ߹ʹɺ੍ݶରͱͨ͠ͱ͖ ʹ3ׂఔύϑΥʔϚϯεྼԽ͕ੜͨ͡ɻ ࢀߟࢿྉ
Slide 55
Slide 55 text
·ͱΊ
Slide 56
Slide 56 text
·ͱΊ ϗεςΟϯάڞ༗αʔόͰ͋ΔͷͰɺΑΓଟ͘ͷਓ͕҆Ձ Ͱշదʹ͝ར༻͍ͨͩͨ͘ΊʹΞΫηε੍ޚඞཁɻ ΞΫηε੍ޚͷ୯ҐΛΑΓࡉ੍͔ͯ͘͠ޚʹΑΔӨڹΛۃখ Խ͠ɺదͳΞΫηε੍ޚΛ࣮ݱͨ͠ɻ ࣮ݱखஈͱͯ͠อकੑɺ֦ுੑɺੑೳͷόϥϯε͕Α͍ mrubyΛ༻͍ͨɻ