Dealing with slow post attack

[Zizhong Zhang <zi...@linkedin.com>]

Hi, ATS DEVs,

Recently I opened PR #2335 which implements body buffering before connecting to downstream.
Apart from some plugins need to know the body before connecting the server, another important reason is to avoid slow-post attack.
Even with activity_timeout and inactivity_timeout, ATS will open connections to origins when receiving slow post and will consume resource of the downstream servers.
Wondering how do other teams deal with slow-post. Is there some solution already can handle it?


Zizhong Zhang
Software Engineer
Traffic Infrastructure
[id:image001.png@01D304CB.AA6B5770]

650.686.8880<tel:(650)%20686-8880>
zizhang@linkedin.com<ma...@linkedin.com>
Linkedin<https://www.linkedin.com/in/zizhong-zhang-2799945a/>

Re: Dealing with slow post attack

[Bryan Call <bc...@apache.org>]

I have seen people use POST buffering to not tie up resources on the origin servers, that can’t handle having a long lived connection.  This problem came up for a group that was having problems with picture uploads taking a long time.  There is a buffer upload plugin that will store the POST body in memory or on disk depending on the configuration.

Docs:
https://docs.trafficserver.apache.org/en/latest/admin-guide/plugins/buffer_upload.en.html?highlight=buffer%20upload <https://docs.trafficserver.apache.org/en/latest/admin-guide/plugins/buffer_upload.en.html?highlight=buffer%20upload>

Code:
https://github.com/apache/trafficserver/tree/master/plugins/experimental/buffer_upload <https://github.com/apache/trafficserver/tree/master/plugins/experimental/buffer_upload>

-Bryan

> On Aug 22, 2017, at 12:42 PM, Zizhong Zhang <zi...@linkedin.com> wrote:
> 
> Hi, ATS DEVs,
>  
> Recently I opened PR #2335 which implements body buffering before connecting to downstream.
> Apart from some plugins need to know the body before connecting the server, another important reason is to avoid slow-post attack.
> Even with activity_timeout and inactivity_timeout, ATS will open connections to origins when receiving slow post and will consume resource of the downstream servers.
> Wondering how do other teams deal with slow-post. Is there some solution already can handle it?
>  
>  
> Zizhong Zhang
> Software Engineer
> Traffic Infrastructure
> <image001.png>
>  
> 650.686.8880 <tel:(650)%20686-8880>
> zizhang@linkedin.com <ma...@linkedin.com>
> Linkedin <https://www.linkedin.com/in/zizhong-zhang-2799945a/>
>