Protect against slow read attack
Right now as long as an attacker continutes to
do a slow read, the connection will stay open forever.
Set a timeout so this can't happen.
Tested: Used slowhttptest to verify this wouldn't
happen
Change-Id: I4dbe2a18f9ccce0ba36875572ec3df6bf3be6a1e
Signed-off-by: James Feist <james.feist@linux.intel.com>
diff --git a/http/timer_queue.h b/http/timer_queue.h
index 7339d66..d7a427e 100644
--- a/http/timer_queue.h
+++ b/http/timer_queue.h
@@ -11,6 +11,9 @@
{
namespace detail
{
+
+constexpr const size_t timerQueueTimeoutSeconds = 5;
+
// fast timer queue for fixed tick value.
class TimerQueue
{
@@ -49,7 +52,8 @@
// remove canceled ones immediately
if (x.second)
{
- if (now - x.first < std::chrono::seconds(5))
+ if (now - x.first <
+ std::chrono::seconds(timerQueueTimeoutSeconds))
{
break;
}