nginx模块，模块的配置使用

2023-01-27 11:31:34

nginx模块
官方模块(默认支持的)
第三方模块

1. --with-http_stub_status_module nginx的客户端状态

配置
syntax: sub_status;
default:-
Context:server,location

location /mystatus{
stub_status;
}

http://192.168.1.251/mystatus

Active connections: 2
server accepts handled requests
134 134 291
Reading: 0 Writing: 1 Waiting: 1 (空的连接的数量，无读写等待)

第一个数字:nginx处理的接收的握手的总的次数
处理的连接数
总的请求数
正常握手和连接数相等表示请求未丢失

location /mystatus{
stub_status;
}
location = /status{
stub_status;
}
/string 开头即可 /string122..均可匹配到
= /string
必须是 /string才能访问到当然/string?a也是可以的

2. --with-http_random_index_module 目录中随机选择一个文件(非目录，非.开头的隐藏文件)访问
random_index_module

Syntax: random_index on|off;
Default:random_index off;
Context:location

location /random {
root /usr/share/nginx/html;
random_index on;
}

[root@localhost110 random]# pwd

/usr/share/nginx/html/random

[root@localhost110 random]# ls -al

总用量

drwxr-xr-x.  root root  -- :: .

drwxr-xr-x.  root root  -- :: ..

-rw-r--r--.  root root  -- :: .html

-rw-r--r--.  root root  -- :: .html

-rw-r--r--.  root root  -- :: .html

-rw-r--r--.  root root  -- :: ..html

drwxr-xr-x.  root root  -- :: a (里有a.html)

-rw-r--r--.  root root  -- :: a.php

随机文件的选择在1.html,2.html,3.html和a.php之间

3. --with-http_sub_module HTTP内容替换
http_sub_module

Syntax: sub_filter string replacement;
Default:-
Context:http,server,location

Syntax: sub_filter_last_modified on|off;
Default:sub_filter_last_modified off;
Context:http,server,location

Syntax: sub_filter_once on|off;
Default:sub_filter_once on;
Context:http,server,location
类似正则的贪婪匹配

location / {
root /usr/share/nginx/html;
index index.html index.htm;
sub_filter 'php' 'PHP';
sub_filter 'js' 'javascript';
sub_filter_once off;
}
submodule.html
php js php Python
java Php JS

被替换成
PHP javascript PHP Python java PHP javascript
发现不区分大小写
不支持正则，可使用第三方模块 ngx_http_substitutions_filter_module 来实现

nginx请求限制
连接频率限制:limit_conn_module
请求频率限制:limit_req_module
http协议的连接与请求

一个连接可发起多个请求
协议版本与请求的关系

HTTP协议版本	连接关系
1.0	TCP不能复用
1.1	顺序性TCP复用
2.0	多路复用TCP复用

HTTP请求建立在一次TCP连接基础上
一次TCP请求至少产生一次HTTP请求
连接限制语法

Syntax:limit_conn_zone key zone=name:size;
default:-
Context:http

Syntax:limit_conn zone number;
Default:-
Context:http ,server,location

请求限制
Syntax:limit_req_zone key zone=name:size rate=rate;
Default:-
Context:http

Syntax:limit_req zone=name [burst=number] [nodelay];
Default:-
Context:http,server,location

测试时使用ab
ab -n 总请求数 -c 并发数 -t 多少时间内 url
ab -n 500 -c 200 http://192.168.1.251/1.html

Concurrency Level:

Time taken for tests:   0.466 seconds

Complete requests:

Failed requests:

Write errors:

Total transferred:       bytes

HTML transferred:        bytes

Requests per second:    1072.16 [#/sec] (mean)

Time per request:       186.539 [ms] (mean)

Time per request:       0.933 [ms] (mean, across all concurrent requests)

Transfer rate:          150.73 [Kbytes/sec] received

配置请求限制后

server外层,http里

limit_req_zone $binary_remote_addr zone=req_zone:1m rate=1r/s;

server {

    listen       ;

    server_name  localhost;

    access_log  /var/log/nginx/host.access.log  main;

    root   /usr/share/nginx/html;

    location / {

        root   /usr/share/nginx/html;

        index  index.html index.htm;

        limit_req zone=req_zone;

    }

}

req_zone表示开辟的空间名,1m表示大小 rate=1r/s 表示1s 1个请求

Concurrency Level:

Time taken for tests:   0.137 seconds

Complete requests:

Failed requests:

   (Connect: , Receive: , Length: , Exceptions: )

Write errors:

Non-2xx responses:

Total transferred:       bytes

HTML transferred:        bytes

Requests per second:    3661.72 [#/sec] (mean)

Time per request:       54.619 [ms] (mean)

Time per request:       0.273 [ms] (mean, across all concurrent requests)

Transfer rate:          1666.92 [Kbytes/sec] received

ab -n  -c  http://192.168.1.251/1.html

Concurrency Level:

Time taken for tests:   0.002 seconds

Complete requests:

Failed requests:

   (Connect: , Receive: , Length: , Exceptions: )

Write errors:

Non-2xx responses:

Total transferred:       bytes

HTML transferred:        bytes

Requests per second:    3180.66 [#/sec] (mean)

Time per request:       0.629 [ms] (mean)

Time per request:       0.314 [ms] (mean, across all concurrent requests)

Transfer rate:          1272.26 [Kbytes/sec] received

只有1个成功

请求日志

192.168.1.251 - - [/Oct/::: +] "GET /1.html HTTP/1.0"   "-" "ApacheBench/2.3" "-"

192.168.1.251 - - [/Oct/::: +] "GET /1.html HTTP/1.0"   "-" "ApacheBench/2.3" "-"

192.168.1.251 - - [/Oct/::: +] "GET /1.html HTTP/1.0"   "-" "ApacheBench/2.3" "-"

192.168.1.251 - - [/Oct/::: +] "GET /1.html HTTP/1.0"   "-" "ApacheBench/2.3" "-"

192.168.1.251 - - [/Oct/::: +] "GET /1.html HTTP/1.0"   "-" "ApacheBench/2.3" "-"

错误日志

// :: [error] #: * limiting requests, excess: 1.000 by zone "req_zone", client: 192.168.1.251, server: localhost, request: "GET /1.html HTTP/1.0", host: "192.168.1.251"

// :: [error] #: * limiting requests, excess: 0.999 by zone "req_zone", client: 192.168.1.251, server: localhost, request: "GET /1.html HTTP/1.0", host: "192.168.1.251"

// :: [error] #: * limiting requests, excess: 0.999 by zone "req_zone", client: 192.168.1.251, server: localhost, request: "GET /1.html HTTP/1.0", host: "192.168.1.251"

// :: [error] #: * limiting requests, excess: 0.999 by zone "req_zone", client: 192.168.1.251, server: localhost, request: "GET /1.html HTTP/1.0", host: "192.168.1.251"

如果上面配置改成

limit_req zone=req_zone burst= nodelay;

ab -n  -c  http://192.168.1.251/1.html

Concurrency Level:

Time taken for tests:   0.001 seconds

Complete requests:

Failed requests:

   (Connect: , Receive: , Length: , Exceptions: )

Write errors:

Non-2xx responses:

Total transferred:       bytes

HTML transferred:        bytes

Requests per second:    6720.43 [#/sec] (mean)

Time per request:       0.298 [ms] (mean)

Time per request:       0.149 [ms] (mean, across all concurrent requests)

Transfer rate:          2118.51 [Kbytes/sec] received

brust表示2个时信任的，给予了2个信任的令牌

对于连接的限制

limit_conn one  ,限制客户端并发连接数量为1

http里

limit_conn_zone $binary_remote_addr zone=conn_zone:1m;

server {

    listen       ;

    server_name  localhost;

    access_log  /var/log/nginx/host.access.log  main;

    root   /usr/share/nginx/html;

    location / {

        root   /usr/share/nginx/html;

        index  index.html index.htm;

        limit_conn conn_zone ;

    }

    ...

}

查看当前tcp连接数

netstat -n | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}'

4. http_access_module(基于ip的访问控制 )

Syntax:allow address |CIDR|unix:|all;

Default:-

Context:http,server,location,limit_except

CIDR 基于网段

Unix：socket方式

all:所有的

Syntax: deny address |CIDR|unix:|all;

Default:-

Context:http,server,location,limit_except

一般allow和deny成对出现

location /admin{

                deny 10.88.1.83;

                allow all;

                index index.html;

 }

 除了10.88.1.，均可访问

 location /admin1{

                allow 10.88.1.0/;

                allow 10.88.2.0/;

                deny all;

                index index.html;

  }

只允许10.88.1./，10.88.2.0/24的网段访问,可配置多个allow

http_access_module局限性

一般的解决方案

1.采用别的http头信息代替remote_addr,如HTTP_X_FORWARD_FOR
X-Forward-For是协议要求,不一定所有的cdn厂商或者代理厂商都会加上，而且可以被客户端修改

http_x_forwarded_for=client ip,proxy(1),proxy(2) ip,....

2.结合geo模块操作

3.通过http自定义变量传递

在访问下一端时通过自定义变量设置http头，把上一级的remote_addr携带到下一端

码农公寓

相关文章