DDoS攻撃との終わりなき戦い/endless_battle_with_ddos_attack

by Takuma Kume

Slide 1

Slide 1 text

ٱถ୓അ / GMO Pepabo, Inc. 2018.06.16 PHPΧϯϑΝϨϯε෱Ԭ %%P4߈ܸͱͷऴΘΓͳ͖ઓ͍

Slide 2

Slide 2 text

(.0ϖύϘΠϯϑϥΤϯδχΞ ٱถ୓അ@takumakume phpinfo() ޷͖ͳ1)1ͷؔ਺

Slide 3

Slide 3 text

%%P4߈ܸͱ͸ʁ

Slide 4

Slide 4 text

΢ΣϒαʔϏε͕Քಇ͍ͯ͠Δαʔό΍ωοτϫʔΫ΁ େྔͷϦΫΤετ΍ڊେͳσʔλΛૹΓ͚ͭΔͳͲͯ͠ αʔϏεΛར༻ෆೳʹ͢Δ wikipedia %P4߈ܸ

Slide 5

Slide 5 text

%P4߈ܸΛେྔͷϚγϯ͔ΒͭͷαʔϏεʹ࢓ֻ͚Δ wikipedia %%P4߈ܸ

Slide 6

Slide 6 text

%P4߈ܸΛେྔͷϚγϯ͔ΒͭͷαʔϏεʹ࢓ֻ͚Δ wikipedia %%P4߈ܸ ߈ܸن໛͕େ͖͍ ෳ਺ͷ*1ΞυϨε͔ΒདྷΔͨΊ੍ޚͮ͠Β͍

Slide 7

Slide 7 text

wϫϯίΠϯ͔Β%%P4߈ܸ͕Ͱ͖ΔαʔϏε͕ଘࡏ wߴߍੜ͕%%P4߈ܸʹΑΓݕڍ w࠷ۙఠൃ͞Εͨwebstresserͱ͍͏αʔϏε wར༻ऀɹɿສઍਓ w߈ܸճ਺ɿສճ wར༻ྉۚɿԁ͘Β͍͔Β ࡢࠓͷ%%P4߈ܸࣄ৘ ୭Ͱ΋खܰʹ%%P4߈ܸ͕Ͱ͖Δ࣌୅

Slide 8

Slide 8 text

Πϯλʔωοτ্Ͱ αʔϏεΛఏڙ͍ͯ͠ΔํͳΒ Ұ౓͘Β͍%%P4߈ܸͷܦݧ ͋Γ·͢ΑͶʁ

Slide 9

Slide 9 text

ຊ೔͸ɺ%%P4߈ܸʹର͢Δ ͰͷऔΓ૊ΈΛ঺հ͠·͢ʂ

Slide 10

Slide 10 text

wલఏɿγεςϜߏ੒ͱ%%P4߈ܸͷӨڹ w՝୊ɿ%%P4߈ܸ΁ͷݱঢ়ͷରԠͱ՝୊ w࣮૷ɿࣗಈԽʹΑΔ%%P4߈ܸͷରԠ w·ͱΊ ໨࣍

Slide 11

Slide 11 text

લఏ ՝୊ ࣮૷ γεςϜߏ੒ͱ %%P4߈ܸͷӨڹ

Slide 12

Slide 12 text

No content

Slide 13

Slide 13 text

ֹ݄ԁ͔Βར༻Ͱ͖Δʂ

Slide 14

Slide 14 text

ֹ݄ԁ͔Βར༻Ͱ͖Δʂ ඵؒ໿ສઍϦΫΤετΛॲཧʂ

Slide 15

Slide 15 text

ֹ݄ԁ͔Βར༻Ͱ͖Δʂ ສαΠτҎ্ӡ༻தʂ ඵؒ໿ສઍϦΫΤετΛॲཧʂ

Slide 16

Slide 16 text

γεςϜߏ੒

Slide 17

Slide 17 text

σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα ϦόʔεϓϩΩγ Πϯλʔωοτ 8αʔό 8αʔό 8αʔό ϦόʔεϓϩΩγ

Slide 18

Slide 18 text

σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα ϦόʔεϓϩΩγ Πϯλʔωοτ 8αʔό 8αʔό 8αʔό ϦόʔεϓϩΩγ σʔληϯλʔΛआΓͯ ΦϯϓϨϛεͰ ߏங͍ͯ͠Δ

Slide 19

Slide 19 text

σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϦόʔεϓϩΩγ Πϯλʔωοτ 8αʔό 8αʔό 8αʔό ϦόʔεϓϩΩγ ϩʔυόϥϯα άϩʔόϧωοτϫʔΫ

Slide 20

Slide 20 text

σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϦόʔεϓϩΩγ Πϯλʔωοτ 8αʔό 8αʔό 8αʔό ϦόʔεϓϩΩγ *1 *1 *1 *1 ϩʔυόϥϯα άϩʔόϧ*1ΞυϨε͕ ݸ΄Ͳ -74 -JOVY7JSUVBM4FSWFS ͷػೳͰ͋Δ*174Λ࢖ͬͨ-#

Slide 21

Slide 21 text

σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα ϦόʔεϓϩΩγ Πϯλʔωοτ 8αʔό 8αʔό 8αʔό ϦόʔεϓϩΩγ αΠτ αΠτ αΠτ αΠτ αΠτ αΠτ αΠτ αΠτ αΠτ ୆͋ͨΓ਺ઍαΠτ ͓٬༷ͷίϯςϯπΛॲཧ͢Δ

Slide 22

Slide 22 text

σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα ϦόʔεϓϩΩγ Πϯλʔωοτ 8αʔό 8αʔό 8αʔό ϦόʔεϓϩΩγ αΠτ αΠτ αΠτ *1 άϩʔόϧ*1͋ͨΓ ୆ͷ8αʔό άϩʔόϧ*1͋ͨΓ ਺ઍαΠτ

Slide 23

Slide 23 text

%%P4߈ܸͷӨڹ

Slide 24

Slide 24 text

σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα ϦόʔεϓϩΩγ Πϯλʔωοτ 8αʔό 8αʔό 8αʔό ϦόʔεϓϩΩγ *1 %%P4߈ܸ ߈ܸର৅

Slide 25

Slide 25 text

σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα ϦόʔεϓϩΩγ Πϯλʔωοτ 8αʔό 8αʔό 8αʔό ϦόʔεϓϩΩγ *1 %%P4߈ܸ ߈ܸର৅ େྔͷτϥϑΟοΫʹΑΓ෺ཧతͳ ωοτϫʔΫଳҬ͕ຒ·ͬͯ͠·͍ ௨ৗͷΞΫηε͕େ͖͘஗Ԇ͢Δ ⾨͜͜ͱ͔ ⾨͜͜

Slide 26

Slide 26 text

Ϩϯλϧαʔόʹ͓͚Δ %%P4߈ܸ

Slide 27

Slide 27 text

Ϩϯλϧαʔόʹ͓͚Δ%%P4߈ܸ 8αʔό 8αʔό 8αʔό αΠτ αΠτ αΠτ αΠτ αΠτ αΠτ αΠτ αΠτ αΠτ ଟछଟ༷ͳɺສҎ্ͷαΠτ ߈ܸͷඪతʹͳΔϦεΫ͕ߴ͍

Slide 28

Slide 28 text

Ϩϯλϧαʔόʹ͓͚Δ%%P4߈ܸ ͲͷαΠτʹର͢Δ߈ܸͳͷ͔෼͔Γʹ͍͘ ͷͰରԠ͠ʹ͍͘ ϩʔυόϥϯα 8αʔό 8αʔό 8αʔό αΠτ αΠτ αΠτ *1 *1ΞυϨε͋ͨΓ਺ઍαΠτ

Slide 29

Slide 29 text

Ϩϯλϧαʔόʹ͓͚Δ%%P4߈ܸ ߈ܸͷେ൒͸)551ϓϩτίϧͰ͸ͳ͍ͷͰ υϝΠϯ໊ͷ৘ใ͸ಘΒΕͳ͍ ϩʔυόϥϯα 8αʔό 8αʔό 8αʔό αΠτ αΠτ αΠτ *1 *1ΞυϨε͋ͨΓ਺ઍαΠτ

Slide 30

Slide 30 text

՝୊ લఏ ࣮૷ %%P4߈ܸ΁ͷ ݱঢ়ͷରԠͱ՝୊

Slide 31

Slide 31 text

%%P4߈ܸΛͭʹ෼ྨ

Slide 32

Slide 32 text

தن໛%%P4߈ܸ w αʔϏεͷܧଓʹӨڹΛ༩͑Δɻ w %$಺ͷଞςφϯτͷαʔϏεʹӨڹͳ͠ɻ σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα Πϯλʔωοτ %%P4߈ܸ ଞςφϯτ ଳҬ͕ຒ·ͬͨ

Slide 33

Slide 33 text

େن໛%%P4߈ܸ σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα Πϯλʔωοτ %%P4߈ܸ ଞςφϯτ ଳҬ͕ຒ·ͬͨ w αʔϏεͷܧଓʹӨڹΛ༩͑Δɻ w %$಺ͷଞςφϯτͷαʔϏεʹӨڹ͋Γɻ

Slide 34

Slide 34 text

ͦΕͧΕͷରԠํ๏

Slide 35

Slide 35 text

தن໛%%P4߈ܸ σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα Πϯλʔωοτ %%P4߈ܸ ଞςφϯτ ଳҬ͕ຒ·ͬͨ

Slide 36

Slide 36 text

தن໛%%P4߈ܸ σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα Πϯλʔωοτ %%P4߈ܸ ଞςφϯτ ଳҬΛ֬อʂ %%P4ରࡦػث ःஅ w %%P4ରࡦػثΛಋೖ w ߈ܸͷύλʔϯʹ߹கͨ͠৔߹ʹ௨৴Λ ःஅ w αʔϏε༻ͷωοτϫʔΫଳҬΛ֬อ

Slide 37

Slide 37 text

େن໛%%P4߈ܸ σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα Πϯλʔωοτ %%P4߈ܸ ଞςφϯτ ଳҬ͕ຒ·ͬͨ

Slide 38

Slide 38 text

େن໛%%P4߈ܸ σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα Πϯλʔωοτ %%P4߈ܸ ଞςφϯτ ଳҬ͕ຒ·ͬͨ %%P4ରࡦػث w %%P4ରࡦػث͕͋ͬͯ΋σʔληϯλʔ಺ ͷωοτϫʔΫଳҬ͕ຒ·Δͱҙຯ͕ͳ͍

Slide 39

Slide 39 text

େن໛%%P4߈ܸ σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα Πϯλʔωοτ %%P4߈ܸ ଞςφϯτ ଳҬΛ֬อ w %$ࣄۀऀ͸߈ܸର৅*1ΞυϨεΛϒ ϥοΫϗʔϧϧʔςΟϯά͢Δ w ߈ܸର৅ͷ*1ΞυϨεͷ௨৴ܦ࿏Λ ۂ͛ͯτϥϑΟοΫΛࣺͯΔ w %$಺ͷଳҬΛ֬อ

Slide 40

Slide 40 text

େن໛%%P4߈ܸ σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα Πϯλʔωοτ %%P4߈ܸ ଞςφϯτ ଳҬΛ֬อ w %$ࣄۀऀ͸߈ܸର৅*1ΞυϨεΛϒϩοΫ ϗʔϧϧʔςΟϯά͢Δ w *1ΞυϨεͷ௨৴ܦ࿏Λۂ͛ͯτϥϑΟοΫ ΛࣺͯΔ w %$಺ͷଳҬΛ֬อ ͜ͷରԠ͕൵ܶΛੜΉ

Slide 41

Slide 41 text

σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα Πϯλʔωοτ 8αʔό 8αʔό 8αʔό αΠτ αΠτ αΠτ *1 େن໛%%P4߈ܸ ߈ܸର৅ ʙ 8αʔό αΠτ αΠτ αΠτ *1 ϩʔυόϥϯα άϩʔόϧ*1͋ͨΓ ୆ͷ8αʔό άϩʔόϧ*1͋ͨΓ ਺ઍαΠτ

Slide 42

Slide 42 text

σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα Πϯλʔωοτ 8αʔό 8αʔό 8αʔό αΠτ αΠτ αΠτ *1 େن໛%%P4߈ܸ ߈ܸର৅ ʙ 8αʔό αΠτ αΠτ αΠτ *1 ϒϥοΫϗʔϧϧʔςΟϯά͞Εͨ*1ΞυϨεʹ ඥͮ͘αΠτ͕Πϯλʔωοτ͔Β࢟Λফ͢ ϩʔυόϥϯα

Slide 43

Slide 43 text

σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον Πϯλʔωοτ 8αʔό 8αʔό 8αʔό αΠτ αΠτ αΠτ *1 େن໛%%P4߈ܸ *1 ʙ ༨৒ͷผ*1ΞυϨεʹ෇͚ସ͑Δ ϩʔυόϥϯα

Slide 44

Slide 44 text

*1ΞυϨεͷ෇͚ସ͑ͷྲྀΕ ϒϥοΫϗʔϧϧʔςΟϯά࣌ʹ%$͔ΒΦϯίʔϧΛड͚Δ γεςϜͷ%#ͱϩʔυόϥϯαʔΛൺֱۭ͖͠*1ΞυϨεΛ୳͢ γεςϜͷ%#ʹ࢖͍ͬͯΔ*1ΞυϨε͕͋Γɺϩʔυόϥϯαʔʹۭ͖ΛؚΉ ͢΂ͯͷ*1ΞυϨε͕*174Ͱ෇༩͞Ε͍ͯΔɻ γεςϜͷ%#ΛΞοϓσʔτ͢Δ ϒϥοΫϗʔϧϧʔςΟϯά͞Εͨ*1ΞυϨεΛ৽͍͠*1ΞυϨεʹ6QEBUFɻ

Slide 45

Slide 45 text

σʔληϯλʔ ฐࣾςφϯτ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον Πϯλʔωοτ 8αʔό 8αʔό 8αʔό αΠτ αΠτ αΠτ *1 *1 ʙ ϩʔυόϥϯα ΞΫηε

Slide 46

Slide 46 text

*1ΞυϨεͷ෇͚ସ͑ͷ՝୊ Φϯίʔϧ΍ॏཁίϯϙʔωϯτͷૢ࡞͸࡞ۀऀ΁ͷετϨε खಈͰ͸ΦϖϨʔγϣϯϛε͕ൃੜ͢ΔϦεΫ͕͋Δ Φϯίʔϧ͔ΒରԠ׬ྃ·Ͱ਺ઍͷαΠτ͕ఀࢭ͢Δ

Slide 47

Slide 47 text

*1ΞυϨεͷ෇͚ସ͑ͷ՝୊ Φϯίʔϧ΍ॏཁίϯϙʔωϯτͷૢ࡞͸࡞ۀऀ΁ͷετϨε खಈͰ͸ΦϖϨʔγϣϯϛε͕ൃੜ͢ΔϦεΫ͕͋Δ ࣗಈԽ΁ Φϯίʔϧ͔ΒରԠ׬ྃ·Ͱ਺ઍͷαΠτ͕ఀࢭ͢Δ

Slide 48

Slide 48 text

࣮૷ લఏ ՝୊ ࣗಈԽʹΑΔ %%P4߈ܸͷରԠ

Slide 49

Slide 49 text

ϒϥοΫϗʔϧϧʔςΟϯά࣌ʹ%$͔ΒΦϯίʔϧΛड͚Δ γεςϜͷ%#ͱϩʔυόϥϯαʔΛൺֱۭ͖͠*1ΞυϨεΛ୳͢ γεςϜͷ%#ΛΞοϓσʔτ͢Δ

Slide 50

Slide 50 text

ϒϥοΫϗʔϧϧʔςΟϯά࣌ʹ%$͔ΒΦϯίʔϧΛड͚Δ γεςϜͷ%#ͱϩʔυόϥϯαʔΛൺֱۭ͖͠*1ΞυϨεΛ୳͢ γεςϜͷ%#ΛΞοϓσʔτ͢Δ Πϯλʔωοτ͔Β*1ΞυϨεͷૄ௨ੑ͕ࣦΘΕΔ͜ͱΛνΣοΫ͢Δ

Slide 51

Slide 51 text

࣮૷ʹ͓͚Δ஫ҙ఺ σʔληϯλʔ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα Πϯλʔωοτ αʔό *1 Πϯλʔωοτ͔Βͷ ೖΓޱΛ੍ޚ͢Δ %$಺͔ΒͰ͸ϒϥοΫϗʔϧϧʔςΟϯάʹؾ͚ͮͳ͍

Slide 52

Slide 52 text

%$಺͔ΒͰ͸ϒϥοΫϗʔϧϧʔςΟϯάʹؾ͚ͮͳ͍ σʔληϯλʔ ήʔτ΢ΣΠεΠον ήʔτ΢ΣΠεΠον ϩʔυόϥϯα Πϯλʔωοτ αʔό *1 σʔληϯλʔ֎͔Β νΣοΫ͢Δඞཁ͕͋Δ

Slide 53

Slide 53 text

νΣοΧʔ ࣗಈԽ ΞϓϦέʔγϣϯ σʔληϯλʔ಺ ผσʔληϯλʔ ϩʔυόϥϯα *1 ᶄ ᶃ ᶅ 1JOHΛ࣮ߦ ݁ՌΛฦ٫ νΣοΫΛґཔ

Slide 54

Slide 54 text

νΣοΧʔ ࣗಈԽ ΞϓϦέʔγϣϯ σʔληϯλʔ಺ ผσʔληϯλʔ ϩʔυόϥϯα *1 ᶄ ᶃ ᶅ 1JOHΛ࣮ߦ ݁ՌΛฦ٫ νΣοΫΛґཔ ൚༻ੑͷߴ͍ΠϯλʔϑΣΠε ʹͯ͠ɺผͷ༻్Ͱ΋࢖͑Δ Α͏ʹ͍ͨ͠ɻ

Slide 55

Slide 55 text

νΣοΧʔ ࣗಈԽ ΞϓϦέʔγϣϯ σʔληϯλʔ಺ ผσʔληϯλʔ ϩʔυόϥϯα *1 ᶄ ᶃ ᶅ νΣοΫΛґཔ 1JOHΛ࣮ߦ ݁ՌΛฦ٫ /icmp?ipaddr=X.X.X.X&timeout=3&max_tries=5 { "status" : true, "error" : "" } 8FC"1*

Slide 56

Slide 56 text

νΣοΧʔ nginx ngx_mruby mruby script HttpRequest JSON mruby-fast-remote-check /icmp?ipaddr=X.X.X.X { "status" : true, "error" : "" } ϩʔυόϥϯα *1ΞυϨε Ping

Slide 57

Slide 57 text

• ngx_mruby wฐࣾͷ!NBUTVNPUPSZ͕։ൃ͍ͯ͠Δ wOHJOYʹ૊ΈࠐΉ͜ͱͰɺϓϩηεͷىಈ΍ϦΫΤετ ͷλΠϛϯάΛܖػʹNSVCZͷεΫϦϓτΛ࣮ߦͰ͖Δ wNSVCZ૊ΈࠐΈ޲͚ͷܰྔ3VCZ • mruby-fast-remote-check wߴ଎ʹϙʔτͷ-JTUFOΛνΣοΫͨ͠Γɺ*$.1ͷνΣο Ϋ͕Ͱ͖ΔNSCHFN 3VCZͰݴ͏HFN νΣοΧʔΛߏ੒͢Δओཁίϯϙʔωϯτ

Slide 58

Slide 58 text

Slide 59

Slide 59 text

location /icmp { mruby_content_handler_code ' # uri = Nginx::Request.new.unparsed_uri # Nginx.rputs RemoteChecker::ICMP.new(uri).execute '; } ࣮ࡍͷίʔυ ϦΫΤετͷURIΛऔಘ ICMPͷνΣοΫΛߦ͍ɺ݁ՌͷJSONΛϨεϙϯε͢Δ RemoteChecker::ICMP.new(uri).execute mruby-fast-remote-checkΛWebAPIͱͯ͠࢖͏ͨΊͷϥούʔΫϥε https://github.com/takumakume/mruby-remote-checker-api

Slide 60

Slide 60 text

RemoteChecker::ICMP.new(uri).execute NSVCZSFNPUFDIFDLFSBQJ ICMPͷνΣοΫ PortͷListenνΣοΫ RemoteChecker::Port.new(uri).execute

Slide 61

Slide 61 text

location /icmp { mruby_content_handler_code ' uri = Nginx::Request.new.unparsed_uri Nginx.rputs RemoteChecker::ICMP.new(uri).execute'; } NSVCZSFNPUFDIFDLFSBQJ location /port { mruby_content_handler_code ' uri = Nginx::Request.new.unparsed_uri Nginx.rputs RemoteChecker::Port.new(uri).execute'; } /icmp?ipaddr=X.X.X.X /port?ipaddr=X.X.X.X&port=80

Slide 62

Slide 62 text

߈ܸ͕ൃੜ͍ͯ͠ͳ͍ͷʹ ͪΒ΄Βμ΢ϯΛݕ஌͢Δ

Slide 63

Slide 63 text

ࣗಈԽ ΞϓϦέʔγϣϯ νΣοΧʔ ϩʔυόϥϯα 1JOHΛ࣮ߦ νΣοΫΛґཔ *1 *1 *1 *1 *1 ෳ਺ͷ*1ΞυϨεʹରͯ͠ಉ࣌ʹॲཧΛґཔ͢ΔͱҰ෦ࣦഊ͢Δ

Slide 64

Slide 64 text

ࣗಈԽ ΞϓϦέʔγϣϯ νΣοΧʔ ϩʔυόϥϯα 1JOHΛ࣮ߦ νΣοΫΛґཔ *1 *1 *1 *1 *1 ෳ਺ͷ*1ΞυϨεʹରͯ͠ಉ࣌ʹॲཧΛґཔ͢ΔͱҰ෦ࣦഊ͢Δ ϩʔυόϥϯα *1 νΣοΧʔ

Slide 65

Slide 65 text

ϓϩηε X.X.X.X ʹ Ping X.X.X.X NIC

Slide 66

Slide 66 text

ϓϩηε X.X.X.X ʹ Ping X.X.X.X NIC Request ICMP Echo Request

Slide 67

Slide 67 text

ϓϩηε X.X.X.X ʹ Ping X.X.X.X socket socket(AF_INET, SOCK_RAW, IPPROTO_ICMP) NIC Request ICMP Echo Request

Slide 68

Slide 68 text

ϓϩηε X.X.X.X ʹ Ping X.X.X.X socket sendto NIC Request

Slide 69

Slide 69 text

ϓϩηε X.X.X.X ʹ Ping X.X.X.X socket recv NIC Request ICMPύέοτΛ଴ͭ recv

Slide 70

Slide 70 text

ϓϩηε X.X.X.X ʹ Ping X.X.X.X socket NIC Reply Reply recv ICMP Echo Reply

Slide 71

Slide 71 text

ϓϩηε X.X.X.X ʹ Ping X.X.X.X socket NIC Reply Reply ICMPύέοτͷ ૹ৴ઌͱૹ৴ݩIPΞυϨε Λൺֱ (ݫີʹ͸ଞʹ΋৚݅͋Γ) ↓ ಉ͡ͳΒtrue ICMP Echo Reply

Slide 72

Slide 72 text

ࣗಈԽ ΞϓϦέʔγϣϯ νΣοΧʔ ϩʔυόϥϯα 1JOHΛ࣮ߦ νΣοΫΛґཔ *1 *1 *1 *1 *1 ෳ਺ͷ*1ΞυϨεʹରͯ͠ಉ࣌ʹॲཧΛґཔ͢ΔͱҰ෦ࣦഊ͢Δ ϩʔυόϥϯα *1 νΣοΧʔ *1

Slide 73

Slide 73 text

ϓϩηε ϓϩηε X.X.X.X ʹ Ping Y.Y.Y.Y ʹ Ping X.X.X.X Y.Y.Y.Y NIC

Slide 74

Slide 74 text

ϓϩηε ϓϩηε X.X.X.X ʹ Ping Y.Y.Y.Y ʹ Ping X.X.X.X Y.Y.Y.Y socket sendto NIC socket Request Request socket

Slide 75

Slide 75 text

ϓϩηε ϓϩηε X.X.X.X ʹ Ping Y.Y.Y.Y ʹ Ping X.X.X.X Y.Y.Y.Y socket NIC socket Request Request recv recv recv

Slide 76

Slide 76 text

ϓϩηε ϓϩηε X.X.X.X ʹ Ping Y.Y.Y.Y ʹ Ping X.X.X.X Y.Y.Y.Y socket NIC socket Reply recv recv

Slide 77

Slide 77 text

ϓϩηε ϓϩηε X.X.X.X ʹ Ping Y.Y.Y.Y ʹ Ping X.X.X.X Y.Y.Y.Y socket NIC socket recv recv Reply Reply

Slide 78

Slide 78 text

raw socket ͸ɺ Linux ͷ͢΂ͯͷ IP ϓϩτίϧΛ ड৴͢Δ͜ͱ͕Ͱ͖Δɻ raw socket ͕ෳ਺͋Ε͹ͦΕͧΕʹ౉͞ΕΔɻ man raw(7)

Slide 79

Slide 79 text

ϓϩηε ϓϩηε X.X.X.X ʹ Ping Y.Y.Y.Y ʹ Ping X.X.X.X Y.Y.Y.Y socket NIC socket recv recv Reply Reply X.X.X.X ͔ΒͷReply

Slide 80

Slide 80 text

ϓϩηε ϓϩηε X.X.X.X ʹ Ping Y.Y.Y.Y ʹ Ping X.X.X.X Y.Y.Y.Y NIC socket recv recvΛϦτϥΠ

Slide 81

Slide 81 text

ϓϩηε ϓϩηε X.X.X.X ʹ Ping Y.Y.Y.Y ʹ Ping X.X.X.X Y.Y.Y.Y NIC socket recv recvΛϦτϥΠ Reply

Slide 82

Slide 82 text

ϓϩηε ϓϩηε X.X.X.X ʹ Ping Y.Y.Y.Y ʹ Ping X.X.X.X Y.Y.Y.Y NIC socket recv Reply Reply

Slide 83

Slide 83 text

ϓϩηε ϓϩηε X.X.X.X ʹ Ping Y.Y.Y.Y ʹ Ping X.X.X.X Y.Y.Y.Y NIC socket recv Reply Reply

Slide 84

Slide 84 text

Slide 85

Slide 85 text

ϒϥοΫϗʔϧϧʔςΟϯά࣌ʹ%$͔ΒΦϯίʔϧΛड͚Δ γεςϜͷ%#ͱϩʔυόϥϯαʔΛൺֱۭ͖͠*1ΞυϨεΛ୳͢ γεςϜͷ%#ΛΞοϓσʔτ͢Δ Πϯλʔωοτ͔Β*1ΞυϨεͷૄ௨ੑ͕ࣦΘΕΔ͜ͱΛνΣοΫ͢Δ SQL ???

Slide 86

Slide 86 text

# ipvsadm -Ln IP Virtual Server version 1.2.1 (size=4096) Prot LocalAddress:Port Scheduler Flags -> RemoteAddress:Port Forward Weight ActiveConn InActConn TCP 203.0.113.1:443 rr -> 192.168.1.100:443 Route 1 1 0 -> 192.168.1.101:443 Route 1 1 0 -> 192.168.1.102:443 Route 1 1 0 TCP 203.0.113.2:443 rr -> 192.168.1.100:443 Route 1 1 0 -> 192.168.1.101:443 Route 1 1 0 -> 192.168.1.102:443 Route 1 1 0 : : ϩʔυόϥϯαʔͷ*1ΞυϨεऔಘ IPVSͷ؅ཧπʔϧ ipvsadm ίϚϯυͷ࣮ߦ݁Ռ

Slide 87

Slide 87 text

Slide 88

Slide 88 text

Slide 89

Slide 89 text

Slide 90

Slide 90 text

ࣗಈԽ ΞϓϦέʔγϣϯ ϩʔυόϥϯα ᶃ ᶄ /services [ { "proto": "TCP", "addr": "203.0.113.1", "port": 443, "sched_name": "rr", "dests": ["192.168.1.100", ..] }, : ] 8FC"1*

Slide 91

Slide 91 text

ϩʔυόϥϯαʔ libipvs nginx ngx_mruby mruby-ipvs mruby script HttpRequest JSON /services [ { "proto": "TCP", "addr": "203.0.113.1", "port": 443, "sched_name": "rr", "dests": ["192.168.1.100", ..] }, : ]

Slide 92

Slide 92 text

• ngx_mruby • mruby-ipvs w!SSSFFFZZZࢯ͕։ൃ͍ͯ͠ΔNSCHFN w*174Λ؅ཧ͢Δ͜ͱ͕Ͱ͖ΔNSVCZͷΠϯλʔϑΣΠε νΣοΧʔΛߏ੒͢Δओཁίϯϙʔωϯτ

Slide 93

Slide 93 text

location /services { mruby_content_handler_code ' # Nginx.rputs JSON.generate(IPVS.services.map(&:to_h)) '; } ίʔυ͸͜Ε͚ͩ IPVSͷαʔϏεҰཡΛऔಘͯ͠JSONʹ͠ɺNginxͰϨεϙϯε͢Δɻ

Slide 94

Slide 94 text

Slide 95

Slide 95 text

ࣗಈԽ ΞϓϦέʔγϣϯ νΣοΧʔ ϩʔυόϥϯα γεςϜ%# ᶃ ࢖༻த*1ΞυϨε ҰཡΛऔಘ

Slide 96

Slide 96 text

ࣗಈԽ ΞϓϦέʔγϣϯ νΣοΧʔ ϩʔυόϥϯα γεςϜ%# ᶃ ᶄ ࢖༻த*1ΞυϨε ҰཡΛऔಘ *1ΞυϨεͷ νΣοΫΛґཔ ᶄ 1*/( *1

Slide 97

Slide 97 text

ࣗಈԽ ΞϓϦέʔγϣϯ νΣοΧʔ ϩʔυόϥϯα γεςϜ%# ᶃ ᶄ ᶅ ࢖༻த*1ΞυϨε ҰཡΛऔಘ *1ΞυϨεͷ νΣοΫΛґཔ *1ΞυϨεͷ νΣοΫ݁ՌΛฦ٫ ᶄ 1*/( *1

Slide 98

Slide 98 text

ࣗಈԽ ΞϓϦέʔγϣϯ νΣοΧʔ ϩʔυόϥϯα γεςϜ%# ᶃ ᶄ ᶅ ᶆ ࢖༻த*1ΞυϨε ҰཡΛऔಘ *1ΞυϨεͷ νΣοΫΛґཔ *1ΞυϨεͷ νΣοΫ݁ՌΛฦ٫ ૄ௨͠ͳ͍*1ΞυϨε͕͋Ε͹ᶇ΁

Slide 99

Slide 99 text

ࣗಈԽ ΞϓϦέʔγϣϯ νΣοΧʔ ϩʔυόϥϯα γεςϜ%# ᶃ ᶄ ᶅ ᶆ ᶇ ࢖༻த*1ΞυϨε ҰཡΛऔಘ *1ΞυϨεͷ νΣοΫΛґཔ *1ΞυϨεͷ νΣοΫ݁ՌΛฦ٫ ૄ௨͠ͳ͍*1ΞυϨε͕͋Ε͹ᶇ΁ ͢΂ͯͷ*1ΞυϨεҰཡΛऔಘ

Slide 100

Slide 100 text

ࣗಈԽ ΞϓϦέʔγϣϯ νΣοΧʔ ϩʔυόϥϯα γεςϜ%# ᶃ ᶄ ᶅ ᶆ ᶇ ᶈ ࢖༻த*1ΞυϨε ҰཡΛऔಘ *1ΞυϨεͷ νΣοΫΛґཔ *1ΞυϨεͷ νΣοΫ݁ՌΛฦ٫ ૄ௨͠ͳ͍*1ΞυϨε͕͋Ε͹ᶇ΁ ͢΂ͯͷ*1ΞυϨεҰཡΛऔಘ ͢΂ͯͷ*1࢖༻தͷ*1 ۭ͖*1ΞυϨε

Slide 101

Slide 101 text

ࣗಈԽ ΞϓϦέʔγϣϯ νΣοΧʔ ϩʔυόϥϯα γεςϜ%# ᶃ ᶄ ᶅ ᶆ ᶇ ᶈ ᶉ ࢖༻த*1ΞυϨε ҰཡΛऔಘ *1ΞυϨεͷ νΣοΫΛґཔ *1ΞυϨεͷ νΣοΫ݁ՌΛฦ٫ ૄ௨͠ͳ͍*1ΞυϨε͕͋Ε͹ᶇ΁ ͢΂ͯͷ*1ΞυϨεҰཡΛऔಘ ͢΂ͯͷ*1࢖༻தͷ*1 ۭ͖*1ΞυϨε %#ͷΞοϓσʔτ

Slide 102

Slide 102 text

·ͱΊ

Slide 103

Slide 103 text

લఏɿγεςϜߏ੒ͱ%%P4߈ܸͷӨڹ w खܰʹ%%P4߈ܸ͕Ͱ͖ΔΑ͏ʹͳͬͨࡢࠓɺϨϯαόۀքͰ΋ྫ֎ͳ ͘߈ܸ͕དྷ͍ͯͯαʔϏεʹӨڹΛٴ΅͍ͯ͠Δɻ w αʔϏε͕େن໛ʹͳΔ΄ͲαΠτ਺͕૿͑ͯඪతʹͳΔϦεΫ͕ߴ͍ɻ

Slide 104

Slide 104 text

લఏɿγεςϜߏ੒ͱ%%P4߈ܸͷӨڹ ՝୊ɿ%%P4߈ܸ΁ͷݱঢ়ͷରԠͱ՝୊ w %$ͷΩϟύγςΟΛ௒͑ΔϨϕϧͷେن໛ͳ߈ܸ͕ൃੜͨ͠৔߹ʹɺ ฐࣾͷ৔߹͸ϒϥοΫϗʔϧϧʔςΟϯά͞ΕΔͨΊखಈରԠ͕ඞཁɻ w खಈରԠͰ͸෮چ͕஗͍͠ɺετϨε౓͕ߴ͍ɻΦϖϛε΋͋ΓಘΔɻ w खܰʹ%%P4߈ܸ͕Ͱ͖ΔΑ͏ʹͳͬͨࡢࠓɺϨϯαόۀքͰ΋ྫ֎ͳ ͘߈ܸ͕དྷ͍ͯͯαʔϏεʹӨڹΛٴ΅͍ͯ͠Δɻ w αʔϏε͕େن໛ʹͳΔ΄ͲαΠτ਺͕૿͑ͯඪతʹͳΔϦεΫ͕ߴ͍ɻ

Slide 105

Slide 105 text

લఏɿγεςϜߏ੒ͱ%%P4߈ܸͷӨڹ ՝୊ɿ%%P4߈ܸ΁ͷݱঢ়ͷରԠͱ՝୊ ࣮૷ɿࣗಈԽʹΑΔ%%P4߈ܸͷରԠ w %$ͷΩϟύγςΟΛ௒͑ΔϨϕϧͷେن໛ͳ߈ܸ͕ൃੜͨ͠৔߹ʹɺ ฐࣾͷ৔߹͸ϒϥοΫϗʔϧϧʔςΟϯά͞ΕΔͨΊखಈରԠ͕ඞཁɻ w खಈରԠͰ͸෮چ͕஗͍͠ɺετϨε౓͕ߴ͍ɻΦϖϛε΋͋ΓಘΔɻ w ϏδωεϩδοΫΛҰՕॴʹूதͤ͞ɺࣗಈԽΛࢧ͑Δίϯϙʔωϯτ ͸Ͱ͖Δ͚ͩ൚༻ੑΛߴ͘͢Δ͜ͱͰศརͰ؅ཧ͠΍͍͢Α͏ʹͨ͠ɻ w ൚༻ੑͷߴ͍ΠϯλʔϑΣΠεͱͯ͠+40/ϕʔεͷ8FC"1*Λ࣮૷͠ ͨɻOHY@NSVCZΛ࢖ͬͯ؆୯ʹ࡞Δ͜ͱ͕Ͱ͖ΔࣄྫΛ঺հͨ͠ɻ w खܰʹ%%P4߈ܸ͕Ͱ͖ΔΑ͏ʹͳͬͨࡢࠓɺϨϯαόۀքͰ΋ྫ֎ͳ ͘߈ܸ͕དྷ͍ͯͯαʔϏεʹӨڹΛٴ΅͍ͯ͠Δɻ w αʔϏε͕େن໛ʹͳΔ΄ͲαΠτ਺͕૿͑ͯඪతʹͳΔϦεΫ͕ߴ͍ɻ

Slide 106

Slide 106 text

͍͞͝ʹ

Slide 107

Slide 107 text

%%P4߈ܸ ͷݕ஌͔Β෮چ·Ͱ͕ ଎͘ɺָʹͳ͚ͬͨͩ

Slide 108

Slide 108 text

Πϯλʔωοτ্Ͱ αʔϏεΛఏڙ͠ଓ͚ΔݶΓ ߈ܸ͸ઈ͑ͣଓ͖·͢

Slide 109

Slide 109 text

1)1ͷίϯςϯπΛ कΔͨΊʹ ʮ%%P4߈ܸͱͷऴΘΓͳ͖ઓ͍ʯ Λଓ͚͍͖͍ͯͨͱࢥ͍·͢ʂ