I wasn't able to raise the load above 0,1 with nginx-0.6.32 on freebsd.<div><br></div><div>What did I wrong if nginx is affected "much stronger"?</div><div><br></div><div>Regards,</div><div>Istvan<br><br><div class="gmail_quote">
On Mon, Jun 22, 2009 at 11:51 AM, Weibin Yao <span dir="ltr"><<a href="mailto:nbubingo@gmail.com">nbubingo@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
w3wsrmn at 2009-6-20 8:09 wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
A look at the script reveals it keeps connections open with invalid headers (note the appended "\r\n"):<br>
<br>
"GET /$rand HTTP/1.1\r\n"<br>
. "Host: $sendhost\r\n"<br>
. "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.503l3; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MSOffice 12)\r\n"<br>
. "Content-Length: 42\r\n";<br>
<br>
As by default the (undocumented?) ignore_invalid_headers directive is enabled in nginx, isn't this attack a non-issue, unless one disables the directive?<br>
<br>
Sending such headers to an nginx server with the directive enabled results in a "400 Bad Request".<br>
<br>
<br>
</blockquote>
When using telnet to send above header, I received the 400 response.<br>
But when I tested the slowloris.pl script in nginx_0.7.59. The ignore_invalid_headers directive is useless, Nginx treate the header_line 'X-a: b\r\n' as valid header.<br>
The debug log is like this:<br>
<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 accept: 172.19.1.209 fd:9<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 event timer add: 9: 60000:120682241<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 epoll add event: fd:9 op:1 ev:80000001<br>
.<br>
.<br>
.<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 http process request line<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 recv: fd:9 236 of 1024<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 http request line: "GET / HTTP/1.1"<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 http uri: "/"<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 http args: ""<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 http exten: ""<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 http process request header line<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 http header: "Host: <a href="http://edu-9.space.163.org" target="_blank">edu-9.space.163.org</a>"<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 http header: "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.503l3; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MSOffice 12)"<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 http header: "Content-Length: 42"<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 recv: fd:9 -1 of 788<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 recv() not ready (11: Resource temporarily unavailable<br>
.<br>
.<br>
.<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 http process request header line<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 recv: fd:9 8 of 788<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 http header: "X-a: b"<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 recv: fd:9 -1 of 780<br>
2009/06/22 16:58:58 [debug] 25864#0: *1 recv() not ready (11: Resource temporarily unavailable)<br>
.<br>
.<br>
.<br>
2009/06/22 16:59:48 [debug] 25864#0: *1 http process request header line<br>
2009/06/22 16:59:48 [debug] 25864#0: *1 recv: fd:9 8 of 780<br>
2009/06/22 16:59:48 [debug] 25864#0: *1 http header: "X-a: b"<br>
2009/06/22 16:59:48 [debug] 25864#0: *1 recv: fd:9 -1 of 772<br>
2009/06/22 16:59:48 [debug] 25864#0: *1 recv() not ready (11: Resource temporarily unavailable)<br>
.<br>
.<br>
.<br>
2009/06/22 16:59:58 [debug] 25864#0: *1 event timer del: 9: 120682241<br>
2009/06/22 16:59:58 [debug] 25864#0: *1 http process request header line<br>
2009/06/22 16:59:58 [info] 25864#0: *1 client timed out (110: Connection timed out) while reading client request headers, client: 172.19.1.209, server: _, request: "GET / HTTP/1.1", host: "<a href="http://edu-9.space.163.org" target="_blank">edu-9.space.163.org</a>"<br>
2009/06/22 16:59:58 [debug] 25864#0: *1 http close request<br>
2009/06/22 16:59:58 [debug] 25864#0: *1 http log handler<br>
2009/06/22 16:59:58 [debug] 25864#0: *1 close http connection: 9<br>
<br>
The default timeout value is 60 seconds. But you can set with client_header_timeout(<a href="http://wiki.nginx.org/NginxHttpCoreModule#client_header_timeout" target="_blank">http://wiki.nginx.org/NginxHttpCoreModule#client_header_timeout</a>), This directive is much useful。<br>
<br>
I think Nginx is also effected by such DoS attack, but much stronger than apache.<br>
<br>
-- <br><font color="#888888">
Weibin Yao<br>
<br>
<br>
</font></blockquote></div><br><br clear="all"><br>-- <br>the sun shines for all<br>
</div>