Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: pass (athena.apache.org: domain of ayyagarikiran@gmail.com
 designates 209.85.192.176 as permitted sender)
MIME-Version: 1.0
Sender: ayyagarikiran@gmail.com
In-Reply-To: <52E782F0.5010606@crown.de>
References: <52E782F0.5010606@crown.de>
Date: Tue, 28 Jan 2014 15:55:45 +0530
Message-ID: 
 <CABzFU-cof0UCKvxOX_O611KgC6LT=9MK3UK3ze+nAaEM6E0eig@mail.gmail.com>
Subject: Re: intercept LDAP request based on IP address
From: Kiran Ayyagari <kayyagari@apache.org>
To: "users@directory.apache.org" <users@directory.apache.org>
Content-Type: multipart/alternative; boundary=047d7b5d92f747f4ef04f1053ff1

--047d7b5d92f747f4ef04f1053ff1
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Tue, Jan 28, 2014 at 3:44 PM, Ute Schr=F6der <us@crown.de> wrote:

> Hi,
>
> I am using apacheDS 2.0.0 M15 embedded into my application. I would like
> to prevent DoS attacks to the LDAP server by blocking repeated requests
> from identical IP addresses.
> My first thought was to use an interceptor, but I found that the first
> method to be called is the lookup() method, and the
> lookupOperationContext does not contain the client's IP address. I get
> the IP address in the bind(BindContext) method, but then I have already
> spent server capacity to check the username and password in the database
> (even if the password is wrong, or the username unknown).
>
> What is the best way to get to the client's IP address before I make a
> database lookup? Is it possible to add a filter to the Mina filter chain
> that is used in apacheDS, and if yes, how can I do that?
>
this is the best way to do
take a look at the start() method in LdapServer class, you can add a filter
to
the IoFilterChainBuilder in there.

Let us know if you run into any issues.

> Using an external firewall to prevent DoS attacks is not feasible,
> unfortunately.
>
> Thank you for your help, and best regards,
> Ute
>
>
>


--=20
Kiran Ayyagari
http://keydap.com

--047d7b5d92f747f4ef04f1053ff1--