Hi all, I have opened a bug report and received confirmation that issues in HTTPD Core are causing the following problems:
- Apache doesn't always return a 408 when a request time out is detected (various cases) - Apache doesn't handle a request time out properly when the URL corresponds to a RedirectMatch directive More details here: https://issues.apache.org/bugzilla/show_bug.cgi?id=51103 Hope that helps someone eventually. Cheers, GB On Fri, Apr 15, 2011 at 9:46 AM, Guillaume Bilodeau < [email protected]> wrote: > A little more information on the 200 return code: > > It seems that mod_reqtimeout is not closing the connection after the 20 > seconds, but rather truncating the request and letting it go through. So > the request is actually processed, and since the URL is referring to an > actual resource, a 200 code is returned. > > Surely there must be a configuration mistake somewhere? > > Cheers, > GB > > On Fri, Apr 15, 2011 at 8:48 AM, Guillaume Bilodeau < > [email protected]> wrote: > >> Hi all, >> >> In order to protect ourselves from a slowloris-type attack, we have >> configured the mod_reqtimeout module on our Apache 2.2.17 installation >> (running on Solaris, MPM compiled). The mod_reqtimeout is configured as >> follows: >> >> RequestReadTimeout header=10-20,MinRate=500 body=10-20,MinRate=500 >> >> We are testing using the OWASP http_dos_cli tool and are still able to >> make the site unreachable in a couple of seconds. In the logs we do see >> that requests are being timed out and the connections closed at the correct >> moment, but the client is receiving a 200 status code instead of a 408. >> This difference keeps our mod_security rule set to gather timeout >> statistics and block further requests from this IP. >> >> Any idea on why mod_reqtimeout is returning 200 and not 408? >> >> The original discussion on the owasp-modsecurity-core-rule-set mailing >> list: >> https://lists.owasp.org/pipermail/owasp-modsecurity-core-rule-set/2011-April/000722.html >> >> Thanks a bunch! >> GB >> >> >
