Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
Message-ID: <4A437E26.2050103@webthing.com>
Date: Thu, 25 Jun 2009 14:39:50 +0100
From: Nick Kew <nick@webthing.com>
User-Agent: Thunderbird 2.0.0.21 (X11/20090323)
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: mod_noloris: mitigating against slowloris-style attack
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

I was just thinking about a quick&dirty fix we could offer
to admins who are suddenly concerned about DoS attack.

The following, backed by dbm or memcache and assuming configurable
default and per-host concurrent connection limits, looks like an
outline candidate and works as a module:

static int noloris_conn(conn_rec *conn)
{
     /* kludge: just limit the number of connections per-ip */
     /* increment num-conn-from-host
      * register pool cleanup to decrement it
      * limit = per-host-limit || default-limit
      * if (num-conn > limit) {
      *     drop connection;
      *     return OK;
      * }
     return DECLINED;
}
static void noloris_hooks(apr_pool_t *p)
{
     ap_hook_process_connection(noloris_conn, NULL, NULL, APR_HOOK_FIRST);
}

Is this worth hacking up, or more trouble than it saves?

-- 
Nick Kew