2

I might be mistaken, but Apache 2.4 docs about mod_reqtimeout and the core functionalities do not explain how the RequestReadTimeout and Timeout directives interact with one another: does one take precedence over the other or do they both apply?

Since I could find no answer to that question, I decided to find it out the old fashioned way: by experimenting.

$ time telnet localhost 80
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.

real    0m51.744s
user    0m0.001s
sys     0m0.005s

And, well, that came unexpected, because my current config seems to tell a different story:

$ sudo apache2ctl -DDUMP_CONFIG | grep -i time
Timeout 300
KeepAliveTimeout 5
# In file: /etc/apache2/mods-enabled/reqtimeout.conf
RequestReadTimeout header=20-40,minrate=500
RequestReadTimeout body=10,minrate=500

So, not only I didn't find the answer to my initial question, but another one just popped up: where does that 51 seconds timeout actually come from? It's not the Timeout directive that specifies it, neither are the timeouts pertaining the header or body stages of the RequestReadTimeout directive.

Wait, could it be... look at that: body=10, and header's max is 40, and 10+40 = 50 which is close enough to 51 (latency and stuff). It makes no much sense because, as far as I've understood, the body timeout should kick in only after the headers have been fully received (right?). But you never know, let's see.

$ sudo apache2ctl -DDUMP_CONFIG | grep -i time
Timeout 300
KeepAliveTimeout 5
# In file: /etc/apache2/mods-enabled/reqtimeout.conf
RequestReadTimeout header=20-30,minrate=500
RequestReadTimeout body=1,minrate=500

So now I should see a ~31s timeout, if the hypothesis is right. Right?

Well...

$ time telnet localhost 80
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.

real    0m51.567s
user    0m0.001s
sys     0m0.005s

I suppose that proves the hypothesis is wrong.

And thus I am left with two questions unanswered: how do the RequestReadTimeout and Timeout directives interact, and why does my apache time out unexpectedly?

BTW:

$ apache2 -v
Server version: Apache/2.4.58 (Ubuntu)
Server built:   2024-04-18T15:13:41
Improve this question

1 Answer 1

Reset to default
1

Answering to myself, since I found the answer to both my questions.

About the "strange" timeout.

Turns out there was another, "hidden", timeout at play, intervening before all the other ones explicitly configured: the AcceptFilter one, which is hardcoded to 30 seconds, according to this answer.

In fact, other people have wondered about the same thing I have: see here and here.

About how do the RequestReadTimeout and Timeout directives interact

They coexist, and the timeout that expires first "wins".

Improve this answer
1
  • 1
    TimeOut measures the whole interaction, includes the time the request takes to be read and the time the request gets to be replied. While requestreadtimeout was a measure to prevent slowloris, where chunks of the request get slowly requested, so you define timeouts for different areas like request headers and request body and define minimum bursts of data for those timeouts to get extended.
    – Daniel Ferradal
    Commented Jun 3 at 19:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .