Hello, I notice strange (in my opinion erroneous and dangerous) behaviour of Apache; very easily can be completely locked by wrong/malicious clients. I think it can have something common with the situation discussed in the thread I point below, although I'm not sure whether the reason is the same. [http://marc.theaimsgroup.com/?l=apache-httpd-users&m=116349385007435&w=2] Configuration: win xp, apache 2.0.48 To make my tests simplier I set in httpd.conf: ThreadsPerChild 1 Using netcat I make the following call: > nc server 80 ...and nothing else... netstat shows the connection is established... Because I have only one child/thread no new request to Apache can be fulfilled. All the new requests (eg. from browser) also establishe the TCP connection... they are queued(?)... I guess they should be rejected (I think IIS makes it this way) and client should get some information... now, no information is returned at all... in browser, it looks like the HTML page is being prepared... what makes users refresh the page and establish new connections... The second issue, more serious, is that there is no timeout for the connection made by netcat. If I disconnected the client computer from the net (physically plug off the net cable) the server child was still busy (waiting for some input...). The only way to make the Apache alive was to restart it. When I make the same trick with IIS, it closes such netcat connection after a few seconds. Is is Apache bug or I make some mistakes in my tests? Errors in configuration? How is it possible to kill the server so easily? Regards, Filip --------------------------------------------------------------------- The official User-To-User support forum of the Apache HTTP Server Project. See <URL:http://httpd.apache.org/userslist.html> for more info. To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx " from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|