Forum Discussion
mattias_56723
Nimbostratus
NimbostratusMitigating Slow HTTP Post DDoS Attacks With iRules
I have tried to implement the "slow http post ddos.." iRule, but I got some errors. http://devcentral.f5.com/Tutorials/...Rules.aspx
when HTTP_REQUEST {
if { [HTTP::method] equal...
mattias_56723Nimbostratus
NimbostratusIs this config appropriate for handling slow post dilemma?
when RULE_INIT {
set static::timeout 20
}
when HTTP_REQUEST {
if { [HTTP::method] equals "POST"} {
if {[HTTP::header Content-Length] > 1}{
set collect_length [HTTP::header Content-Length]
set timeout $static::timeout } }
if {[info exists collect_length]}{
set id [after $timeout {
HTTP::respond 500 content "Your POST is to slow"
TCP::close
}]
HTTP::collect $collect_length
}
}
when HTTP_REQUEST_DATA {
if {[info exists id]} {
after cancel $id
}
}