[Bug 61310] mod_reqtimeout does not timeout during SSL handshakes

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=61310

--- Comment #1 from dferradal@apache.org ---
as replied in #httpd in irc:

mod_reqtimeout deals with HTTP attacks, checks the timing for HTTP requests,
including headers, body.

HTTP communication does no happen until SSL negotiation has been established
correctly.

So it is normal openssl timesout with mod_reqtimeout because SSL negotiation
has been stablished already.

And it is normal telnet timesout with global server config timeout instead of
mod_reqtimeout, because SSL negotiation has not been made and thus we are not
in http communication yet.

I'd declare this INVALID.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org