I'm not sure that any mod_perl handlers are dispatched until the whole
request is received, so you may have to deal with this at the core Apache
level.
I think the following is your best bet (from
http://httpd.apache.org/docs/mod/core.html#timeout )
>TimeOut directive
>
>Syntax: TimeOut number
>Default: TimeOut 300
>Context: server config
>Status: core
>
>The TimeOut directive currently defines the amount of time Apache will
>wait for three things:
>
> 1.The total amount of time it takes to receive a GET request.
> 2.The amount of time between receipt of TCP packets on a POST or PUT
> request.
> 3.The amount of time between ACKs on transmissions of TCP packets in
> responses.
>
>We plan on making these separately configurable at some point down the
>road. The timer used to default to 1200 before 1.2, but has been lowered
>to 300 which is still far more than necessary in most situations. It is
>not set any lower by default because there may still be odd places in the code
>where the timer is not reset when a packet is sent.
We've experienced this kind of attack inadvertently (as the result of a
totally misconfigured HTTP client app which froze in the middle of sending
an HTTP request ;=) but I wasn't aware that there were known attacks based
on that.
-Simon
At 11:09 AM 9/26/2001, Bill McGonigle wrote:
>I'm hoping this is possible with mod_perl, since I'm already familiar with
>it and fairly allergic to c, but can't seem to figure out the right phase.
>
>I've been seeing log files recently that point to a certain DDOS attack
>brewing on apache servers. I want to write a module that keeps a timer
>for the interval from when the apache child gets a network connection to
>when the client request has been sent.
>
>I need a trigger when a network connection is established and a trigger
>when apache thinks it has received the request (before the response).
>
>PerlChildInitHandler seems too early, since the child may be a pre-forked
>child without a connection. PerlPostReadRequest seems too late since I
>can't be guaranteed of being called if the request isn't complete, which
>is the problem I'm trying to solve. I could clear a flag in
>PerlPostReadRequest, but that would imply something is persisting from
>before that would be able to read the flag.
>
>Maybe I'm think about this all wrong. Any suggestions?
>
>Thanks,
>-Bill
-----------------------------------------------------
Simon Rosenthal ([EMAIL PROTECTED])
Web Systems Architect
Northern Light Technology
One Athenaeum Street. Suite 1700, Cambridge, MA 02142
Phone: (617)621-5296: URL: http://www.northernlight.com
"Northern Light - Just what you've been searching for"
