From owner-freebsd-security@FreeBSD.ORG Fri Oct 2 08:49:02 2009 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id C79151065692 for ; Fri, 2 Oct 2009 08:49:02 +0000 (UTC) (envelope-from leccine@gmail.com) Received: from mail-bw0-f227.google.com (mail-bw0-f227.google.com [209.85.218.227]) by mx1.freebsd.org (Postfix) with ESMTP id 471B08FC35 for ; Fri, 2 Oct 2009 08:49:01 +0000 (UTC) Received: by bwz27 with SMTP id 27so755692bwz.43 for ; Fri, 02 Oct 2009 01:49:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=IgJpJkchziLNnhkNs2atkSKV9UxCN4yYEmItq2pi0ss=; b=GM14LMCtSn+2WVZwHnyHlKQlCkGvf537OA/R1dVvCluxg4sE55spaOUQZXZLj6j2gT FrfamP+UL7MIKRxAxwN7NFQ6EZUK5DSezSayV1jdr0G6cjRRaqepWCAf611LsFU+Nv8z 7Ht08yLIVMr26t8TPsdeLJHo6cyEIlOolLCuU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=rH5V9+FTc0HmEWIDBS72HS9it2t4NuYByxnaoioRzi1v2RjfsLtCKeovBPT9FwJ2se 0Q3c5Hn6tibOR3xD1UVTEgwjJTGudsdUi7e6rgaiDA3q7V5xvysRoqLtjyDBNcC2skom C/MmQ29pabrq3IAfq7GZdlFdnBW7OFNeNSCWY= MIME-Version: 1.0 Received: by 10.204.24.81 with SMTP id u17mr919753bkb.202.1254473340316; Fri, 02 Oct 2009 01:49:00 -0700 (PDT) In-Reply-To: <1254471526.54871.10.camel@strangepork.london.mintel.ad> References: <4AC37D6B.3060409@optiksecurite.com> <4AC3FA90.1000405@gibfest.dk> <1254387556.39148.10.camel@strangepork.london.mintel.ad> <4E7E6B51-2B63-459C-A6FE-F327E899DCF6@anduin.net> <1254471526.54871.10.camel@strangepork.london.mintel.ad> Date: Fri, 2 Oct 2009 09:49:00 +0100 Message-ID: From: =?ISO-8859-1?B?SXN0duFu?= To: Tom Evans Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: Thomas Rasmussen , freebsd-security@freebsd.org, =?ISO-8859-1?Q?Eirik_=D8verby?= Subject: Re: Update on protection against slowloris X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Oct 2009 08:49:03 -0000 hmm, i am curious as well, lets wait to 2.4 On Fri, Oct 2, 2009 at 9:18 AM, Tom Evans wrote: > On Thu, 2009-10-01 at 19:46 +0100, Istv=E1n wrote: > > "The bad news is that it can indeed take a badly-configured apache > > server down, and the worse news is that that includes a low-traffic > > out-of-the box configuration. Even with the Event MPM, slowloris can > > tie up one worker thread per connection." > > > > > > > > > > for sure > > > > It doesn't tie up one thread, one thread is partially occupied by > waiting for the slowloris connection to finish sending the request. That > thread can still handle other connections that are sending requests. In > our tests, running a couple of slowloris instances against event MPM had > virtually no effect. > > Cheers > > Tom > > --=20 the sun shines for all