Re: Hash Table Collisions (n.runs-SA-2011.004)

[David Favro <lua@...>]

On 01/03/2012 06:28 PM, Petite Abeille wrote:
> In the meantime, feel free  to break Nanoki, which sports an HTTP server implemented in pure Lua.

I had a rather amateurish go at Mr. Abeille's generous offer to DoS his
server using the method he described (colliding HTTP headers), and
tcpserver+Nanoki seemed to serve it well.  36k colliding headers (1.2MB)
does fine to seize up the processing of the request, but after 60s it's
canceled as expected (the same request, with non-colliding headers, only
takes 6s total round-trip).

I never degraded the response time for legitimate requests below a few
seconds, perhaps because my ISP limits my upstream bandwidth or perhaps due
to some other problem in my attempts to get many simultaneous requests going.

-- David