nginx模块，模块的配置使用

nginx模块
官方模块(默认支持的)
第三方模块

1. --with-http_stub_status_module nginx的客户端状态

配置
syntax: sub_status;
default:-
Context:server,location

location /mystatus{
stub_status;
}

http://192.168.1.251/mystatus

Active connections: 2
server accepts handled requests
134 134 291
Reading: 0 Writing: 1 Waiting: 1 (空的连接的数量，无读写等待)

第一个数字:nginx处理的接收的握手的总的次数
处理的连接数
总的请求数
正常握手和连接数相等表示请求未丢失

location /mystatus{
stub_status;
}
location = /status{
stub_status;
}
/string 开头即可 /string122..均可匹配到
= /string
必须是 /string才能访问到 当然/string?a也是可以的

2. --with-http_random_index_module 目录中随机选择一个文件(非目录，非.开头的隐藏文件)访问
random_index_module

Syntax: random_index on|off;
Default:random_index off;
Context:location

location /random {
root /usr/share/nginx/html;
random_index on;
}

[root@localhost110 random]# pwd
/usr/share/nginx/html/random
[root@localhost110 random]# ls -al
总用量
drwxr-xr-x.  root root  -- :: .
drwxr-xr-x.  root root  -- :: ..
-rw-r--r--.  root root  -- :: .html
-rw-r--r--.  root root  -- :: .html
-rw-r--r--.  root root  -- :: .html
-rw-r--r--.  root root  -- :: ..html
drwxr-xr-x.  root root  -- :: a (里有a.html)
-rw-r--r--.  root root  -- :: a.php

随机文件的选择在1.html,2.html,3.html和a.php之间

3. --with-http_sub_module HTTP内容替换
http_sub_module

Syntax: sub_filter string replacement;
Default:-
Context:http,server,location

Syntax: sub_filter_last_modified on|off;
Default:sub_filter_last_modified off;
Context:http,server,location

Syntax: sub_filter_once on|off;
Default:sub_filter_once on;
Context:http,server,location
类似正则的贪婪匹配

location / {
root /usr/share/nginx/html;
index index.html index.htm;
sub_filter 'php' 'PHP';
sub_filter 'js' 'javascript';
sub_filter_once off;
}
submodule.html
php js php Python
java Php JS

被替换成
PHP javascript PHP Python java PHP javascript
发现不区分大小写
不支持正则，可使用 第三方模块 ngx_http_substitutions_filter_module 来实现

nginx请求限制
连接频率限制:limit_conn_module
请求频率限制:limit_req_module
http协议的连接与请求

一个连接可发起多个请求
协议版本与请求的关系

HTTP协议版本	连接关系
1.0	TCP不能复用
1.1	顺序性TCP复用
2.0	多路复用TCP复用

HTTP请求建立在一次TCP连接基础上
一次TCP请求至少产生一次HTTP请求
连接限制语法

Syntax:limit_conn_zone key zone=name:size;
default:-
Context:http

Syntax:limit_conn zone number;
Default:-
Context:http ,server,location

请求限制
Syntax:limit_req_zone key zone=name:size rate=rate;
Default:-
Context:http

Syntax:limit_req zone=name [burst=number] [nodelay];
Default:-
Context:http,server,location

测试时使用ab
ab -n 总请求数 -c 并发数 -t 多少时间内 url
ab -n 500 -c 200 http://192.168.1.251/1.html

Concurrency Level:
Time taken for tests:   0.466 seconds
Complete requests:
Failed requests:
Write errors:
Total transferred:       bytes
HTML transferred:        bytes
Requests per second:    1072.16 [#/sec] (mean)
Time per request:       186.539 [ms] (mean)
Time per request:       0.933 [ms] (mean, across all concurrent requests)
Transfer rate:          150.73 [Kbytes/sec] received

配置请求限制后
server外层,http里
limit_req_zone $binary_remote_addr zone=req_zone:1m rate=1r/s;
server {
    listen       ;
    server_name  localhost;
    access_log  /var/log/nginx/host.access.log  main;
    root   /usr/share/nginx/html;
    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
        limit_req zone=req_zone;
    }
}

req_zone表示开辟的空间名,1m表示大小 rate=1r/s 表示1s 1个请求

Concurrency Level:
Time taken for tests:   0.137 seconds
Complete requests:
Failed requests:
   (Connect: , Receive: , Length: , Exceptions: )
Write errors:
Non-2xx responses:
Total transferred:       bytes
HTML transferred:        bytes
Requests per second:    3661.72 [#/sec] (mean)
Time per request:       54.619 [ms] (mean)
Time per request:       0.273 [ms] (mean, across all concurrent requests)
Transfer rate:          1666.92 [Kbytes/sec] received

ab -n  -c  http://192.168.1.251/1.html

Concurrency Level:
Time taken for tests:   0.002 seconds
Complete requests:
Failed requests:
   (Connect: , Receive: , Length: , Exceptions: )
Write errors:
Non-2xx responses:
Total transferred:       bytes
HTML transferred:        bytes
Requests per second:    3180.66 [#/sec] (mean)
Time per request:       0.629 [ms] (mean)
Time per request:       0.314 [ms] (mean, across all concurrent requests)
Transfer rate:          1272.26 [Kbytes/sec] received

只有1个成功
请求日志
192.168.1.251 - - [/Oct/::: +] "GET /1.html HTTP/1.0"   "-" "ApacheBench/2.3" "-"
192.168.1.251 - - [/Oct/::: +] "GET /1.html HTTP/1.0"   "-" "ApacheBench/2.3" "-"
192.168.1.251 - - [/Oct/::: +] "GET /1.html HTTP/1.0"   "-" "ApacheBench/2.3" "-"
192.168.1.251 - - [/Oct/::: +] "GET /1.html HTTP/1.0"   "-" "ApacheBench/2.3" "-"
192.168.1.251 - - [/Oct/::: +] "GET /1.html HTTP/1.0"   "-" "ApacheBench/2.3" "-"
错误日志
// :: [error] #: * limiting requests, excess: 1.000 by zone "req_zone", client: 192.168.1.251, server: localhost, request: "GET /1.html HTTP/1.0", host: "192.168.1.251"
// :: [error] #: * limiting requests, excess: 0.999 by zone "req_zone", client: 192.168.1.251, server: localhost, request: "GET /1.html HTTP/1.0", host: "192.168.1.251"
// :: [error] #: * limiting requests, excess: 0.999 by zone "req_zone", client: 192.168.1.251, server: localhost, request: "GET /1.html HTTP/1.0", host: "192.168.1.251"
// :: [error] #: * limiting requests, excess: 0.999 by zone "req_zone", client: 192.168.1.251, server: localhost, request: "GET /1.html HTTP/1.0", host: "192.168.1.251"

如果上面配置改成
limit_req zone=req_zone burst= nodelay;

ab -n  -c  http://192.168.1.251/1.html

Concurrency Level:
Time taken for tests:   0.001 seconds
Complete requests:
Failed requests:
   (Connect: , Receive: , Length: , Exceptions: )
Write errors:
Non-2xx responses:
Total transferred:       bytes
HTML transferred:        bytes
Requests per second:    6720.43 [#/sec] (mean)
Time per request:       0.298 [ms] (mean)
Time per request:       0.149 [ms] (mean, across all concurrent requests)
Transfer rate:          2118.51 [Kbytes/sec] received

brust表示2个时信任的，给予了2个信任的令牌

对于连接的限制

limit_conn one  ,限制客户端并发连接数量为1

http里
limit_conn_zone $binary_remote_addr zone=conn_zone:1m;

server {
    listen       ;
    server_name  localhost;
    access_log  /var/log/nginx/host.access.log  main;
    root   /usr/share/nginx/html;
    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
        limit_conn conn_zone ;
    }
    ...
}
查看当前tcp连接数
netstat -n | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}'

4.  http_access_module(基于ip的访问控制 )

Syntax:allow address |CIDR|unix:|all;
Default:-
Context:http,server,location,limit_except

CIDR 基于网段
Unix：socket方式
all:所有的

Syntax: deny address |CIDR|unix:|all;
Default:-
Context:http,server,location,limit_except

一般allow和deny成对出现

location /admin{
                deny 10.88.1.83;
                allow all;
                index index.html;
 }
 除了10.88.1.，均可访问
 location /admin1{
                allow 10.88.1.0/;
                allow 10.88.2.0/;
                deny all;
                index index.html;
  }
只允许10.88.1./，10.88.2.0/24的网段访问,可配置多个allow

http_access_module局限性

一般的解决方案

1.采用别的http头信息代替remote_addr,如HTTP_X_FORWARD_FOR
X-Forward-For是协议要求,不一定所有的cdn厂商或者代理厂商都会加上，而且可以被客户端修改

http_x_forwarded_for=client ip,proxy(1),proxy(2) ip,....

2.结合geo模块操作

3.通过http自定义变量传递

在访问下一端时通过自定义变量设置http头，把上一级的remote_addr携带到下一端