[GitHub] [netbeans] jgneff commented on issue #4890: Building with proxies causes DoS attack on OSU

[GitBox <gi...@apache.org>]

jgneff commented on issue #4890:
URL: https://github.com/apache/netbeans/issues/4890#issuecomment-1299281879

   > The NetBeans build makes over 95 connections through the Squid proxy server to `netbeans.osuosl.org`, so I'm surprised that it sometimes works. ... I'll look into it.
   
   Here's what I found. The NetBeans build avoids the connection limit of `mod_limitipconn` by not sending any request headers at all. That module hooks in too late in the request processing phase to enforce its limit on such unused, idle connections. Looking at the source code:
   
   * the earliest hook for `mod_reqtimeout` is `ap_hook_process_connection`, called during connection processing, while
   * the earliest hook for `mod_limitipconn` is `ap_hook_quick_handler`, called later during request processing when the request headers are read and parsed.
   
   My experiments confirm this. I can make 100 connections to `netbeans.osuosl.org` through the proxy server, perform the TLS handshake, and as long as no request headers are sent, they'll just sit there for 20 seconds until they are closed by `mod_reqtimeout`. If, on the other hand, I make 40 connections and send the request headers immediately, only 8 of them are successful. The other 32 return "503 Service Unavailable" due to the per-IP connection limit of `mod_limitipconn`.
   
   There's an experimental [`mod_noloris`](https://github.com/apache/httpd/blob/trunk/modules/experimental/mod_noloris.c) from Apache that looks interesting and appears to enforce the per-IP connection limit earlier. See also [`mod_antiloris`](https://github.com/Deltik/mod_antiloris) and a good write-up called ["Slowloris And Mitigations For Apache"](https://blog.macuyiko.com/post/2011/slowloris-and-mitigations-for-apache.html).
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org

For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists