Apache: Short Lingering Close

[studersi]

Looking through the source code of mod_reqtimeout, I saw that it uses the short-lingering-close request note to considerably shorten the potential duration of a lingering connection close:
https://github.com/apache/httpd/blob/trunk/modules/filters/mod_reqtimeout.c#L329-L335

I did not see this note being used in ModSecurity, though I'm not sure whether this is even applicable for ModSecurity or whether ModSecurity foregoes the lingering close completely.

[marcstern]

That mechanism is used to oblige the client to read the answer quicker than normal.
I don't see any reason to do that in ModSecurity, except maybe in hook_connection_early() when the client has too many open connections?

Additional question: Is this behaviour (SecConnReadStateLimit/SecConnWriteStateLimit) still useful?

1. Many ISP (especially mobile) use Carrier NAT, so many users are using the same IP => blocking genuine users
2. How does it interact with HTTP/2? You can have many requests in parallel in a single connection => limit not effective

[airween]

@studersi, @marcstern is there any conclusions here?

[marcstern]

I unfortunately have no more info than in my last remark: I don't see any reason to do that in ModSecurity, except maybe in hook_connection_early() when the client has too many open connections?

[studersi]

Honestly, I am not sure either.

The fact that Apache explicitly uses it in cases where the client might be keeping open connections longer than necessary suggests there might be some use in doing so. The same goes for mod_qos, whose developer intends to add this in a future release: https://sourceforge.net/p/mod-qos/discussion/697421/thread/f50e74ea73/.

I guess it might might be helpful anytime there are clients that try to keep up connections for as long as possible. This could be the case when they become unresponsive or during DDoS attacks. While this might not be the main purpose of ModSecurity, there are CRS Plugins that might profit from this, nevertheless: https://github.com/coreruleset/dos-protection-plugin-modsecurity.

While true that it's increasingly more difficult to block on an IP-basis, the short-lingering-close feature works on a connection basis, from what I understand, and does not necessarily affect all connections for an IP.

Feel free to close this if you feel there is no need for this.

[marcstern]

From what I understand, it allows to close the connection quicker in case the request wasn't complete.
So, I guess it may be a good idea inside hook_connection_early() where we indeed cut the connection before receiving all data.
For the rest, I don't see any advantages in adding it.