Re: mod_noloris: mitigating against slowloris-style attack

2009-07-01 Thread Nick Kew
fredk2 wrote: Hi Nick, I looked at the code (I am not a coder) and wondered what made you say it's geared clearly to the very small server. It gives you the overhead of reading the entire scoreboard for every request. You don't want to do that with high traffic, nor with anything but a very

Re: Creating a new thread inside a module

2009-07-01 Thread h iroshan
Hi William and Mladen, Thanks both of you but i am still struggling with my thread creation. I create my background thread inside the balancer_init method at mod_proxy_balancer module. But after finished the execution of balancer_init method my thread also terminate automatically please help me

Re: Creating a new thread inside a module

2009-07-01 Thread shaniro herath
Hi Iroshan and All, Same problem here. I passed function with infinite while loop when creating the thread . Thread creation is done inside a function of another module. But after call the module function thread also terminate. What are the steps that I have missed here. Thank you. Shaniro

Re: Creating a new thread inside a module

2009-07-01 Thread Mladen Turk
shaniro herath wrote: Hi Iroshan and All, Same problem here. I passed function with infinite while loop when creating the thread . Thread creation is done inside a function of another module. But after call the module function thread also terminate. What are the steps that I have missed

Re: mod_noloris: mitigating against slowloris-style attack

2009-07-01 Thread Jeff Trawick
On Wed, Jul 1, 2009 at 5:12 AM, Nick Kew n...@webthing.com wrote: fredk2 wrote: Hi Nick, I looked at the code (I am not a coder) and wondered what made you say it's geared clearly to the very small server. It gives you the overhead of reading the entire scoreboard for every request.

Re: mod_noloris: mitigating against slowloris-style attack

2009-07-01 Thread Nick Kew
Jeff Trawick wrote: On Wed, Jul 1, 2009 at 5:12 AM, Nick Kew n...@webthing.com mailto:n...@webthing.com wrote: fredk2 wrote: Hi Nick, I looked at the code (I am not a coder) and wondered what made you say it's geared clearly to the very small server.

Re: mod_noloris: mitigating against slowloris-style attack

2009-07-01 Thread Gonzalo Arana
Hi, Keeping whitelist up to date is rather tricky. How about having any/all of these directives? # time between accept(2) call and the full request has been read. RequestTimeout 1 # minimum bandwith the user should have available to access this server. MinInRate 2KB/s MinOutRate

Re: mod_noloris: mitigating against slowloris-style attack

2009-07-01 Thread Nick Kew
Nick Kew wrote: I've actually hacked up mod_noloris to do exactly that. Was planning to test-drive then post, but since you bring the matter up, I'll attach it here and now. Having already fixed a couple of typos in the attachment, I've uploaded to http://people.apache.org/~niq/mod_noloris.c

Re: mod_noloris: mitigating against slowloris-style attack

2009-07-01 Thread Nick Kew
Gonzalo Arana wrote: Hi, Keeping whitelist up to date is rather tricky. How about having any/all of these directives? # time between accept(2) call and the full request has been read. RequestTimeout 1 # minimum bandwith the user should have available to access this server. MinInRate

Re: mod_noloris: mitigating against slowloris-style attack

2009-07-01 Thread Eric Covener
On Wed, Jul 1, 2009 at 8:49 AM, Nick Kewn...@webthing.com wrote: Gonzalo Arana wrote: Hi, Keeping whitelist up to date is rather tricky. How about having any/all of these directives? # time between accept(2) call and the full request has been read. RequestTimeout   1 Also interested

Re: mod_noloris: mitigating against slowloris-style attack

2009-07-01 Thread Dan Poirier
To avoid a ban on 89.0.0.13 also banning 9.0.0.1, we might want to include the separators in the strstr, as in the attached patch. --- mod_noloris.c-orig 2009-07-01 08:57:32.0 -0400 +++ mod_noloris.c 2009-07-01 09:15:21.918474373 -0400 @@ -61,7 +61,7 @@ * accepts a conn_rec.

Re: mod_noloris: mitigating against slowloris-style attack

2009-07-01 Thread Gonzalo Arana
On Wed, Jul 1, 2009 at 9:49 AM, Nick Kewn...@webthing.com wrote: Gonzalo Arana wrote: Hi, Keeping whitelist up to date is rather tricky. How about having any/all of these directives? # time between accept(2) call and the full request has been read. RequestTimeout   1 # minimum bandwith

Re: Creating a new thread inside a module

2009-07-01 Thread William A. Rowe, Jr.
h iroshan wrote: Hi William and Mladen, Thanks both of you but i am still struggling with my thread creation. I create my background thread inside the balancer_init method at mod_proxy_balancer module. But after finished the execution of balancer_init method my thread also terminate

Re: svn commit: r790205 - /httpd/httpd/trunk/modules/experimental/mod_noloris.c

2009-07-01 Thread Ruediger Pluem
tOn 01.07.2009 17:01, n...@apache.org wrote: Author: niq Date: Wed Jul 1 15:01:55 2009 New Revision: 790205 URL: http://svn.apache.org/viewvc?rev=790205view=rev Log: mod_noloris just moved from discussion to attracting its first patch on d...@. That means it wants to be in svn. Adding

Re: svn commit: r790205 - /httpd/httpd/trunk/modules/experimental/mod_noloris.c

2009-07-01 Thread Paul Querna
On Wed, Jul 1, 2009 at 8:01 AM, n...@apache.org wrote: Author: niq Date: Wed Jul  1 15:01:55 2009 New Revision: 790205 URL: http://svn.apache.org/viewvc?rev=790205view=rev Log: mod_noloris just moved from discussion to attracting its first patch on d...@.  That means it wants to be in svn.

Re: svn commit: r790205 - /httpd/httpd/trunk/modules/experimental/mod_noloris.c

2009-07-01 Thread William A. Rowe, Jr.
Ruediger Pluem wrote: I am not sure if doing this for each connection (not each *request*) is really that much of a performace hit. I used a modified version of mod_limitipcon and do just that. So far I haven't noticed any performance issues with this approach. But maybe with a maximum of

Re: svn commit: r790205 - /httpd/httpd/trunk/modules/experimental/mod_noloris.c

2009-07-01 Thread Nick Kew
Ruediger Pluem wrote: + * The major difference is that mod_antiloris checks the scoreboard + * on every request. This implies a per-request overhead that grows + * with the scoreboard, and gets very expensive on a big server. + * On the other hand, this module (mod_noloris) may be slower to +

Re: Creating a new thread inside a module

2009-07-01 Thread shaniro herath
Hi, please can anybody roughly tell me how to register a new thread under the main child thread pool .It is great help for me. Shaniro Herath. On Wed, Jul 1, 2009 at 9:44 PM, William A. Rowe, Jr. wr...@rowe-clan.netwrote: h iroshan wrote: Hi William and Mladen, Thanks both of you