https://bz.apache.org/bugzilla/show_bug.cgi?id=70215

Jason Lingohr <[email protected]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #2 from Jason Lingohr <[email protected]> ---
Fixed in trunk as r1938527.

I've added a new "Connection and Handshake Timeouts" section to the mod_ssl
documentation, which explains that the HTTP-level timeouts (such as TimeOut)
don't cover a client that stalls during the TLS handshake, and that you need to
configure the handshake stage of mod_reqtimeout's RequestReadTimeout to time
those connections out:

  RequestReadTimeout handshake=5

The handshake stage is disabled by default and has been available since httpd
2.4.39. I also added a cross-reference to RequestReadTimeout from the mod_ssl
summary, and updated the RequestReadTimeout bullet in misc/security_tips.xml to
call out the TLS handshake case.

Thanks for the report.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to