[
https://issues.apache.org/jira/browse/THRIFT-3957?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claudius Heine updated THRIFT-3957:
-----------------------------------
Description:
When starting the TestServer with the first appended patch:
{code}
bin/TestServer --protocol=json --transport=http --server-type=thread-pool
--port=9080
{code}
And connecting to it with this shell command:
{code}
wget --post-data='[' http://localhost:9080
{code}
The connection stays up for a long time. Making DOS attacks very easy, because
at some point the server runs out of available client connections.
The second appended patch fixes the issue in TConnectedClient.
was:
When starting the TestServer with the appended patch:
{code}
bin/TestServer --protocol=json --transport=http --server-type=thread-pool
--port=9080
{code}
And connecting to it with this shell command:
{code}
wget --post-data='[' http://localhost:9080
{code}
The connection stays up for a long time. Making DOS attacks very easy, because
at some point the server runs out of available client connections.
The appended patch fixes the issue in TConnectedClient.
> TConnectedClient does not disconnect from clients when their timeout is
> reached.
> --------------------------------------------------------------------------------
>
> Key: THRIFT-3957
> URL: https://issues.apache.org/jira/browse/THRIFT-3957
> Project: Thrift
> Issue Type: Bug
> Components: C++ - Library
> Affects Versions: 1.0
> Reporter: Claudius Heine
> Attachments:
> 0001-cpp-TestServer-removed-while-loop-and-added-connecti.patch,
> 0002-cpp-server-TConnectedClient-Timeouts-are-disconnecti.patch
>
>
> When starting the TestServer with the first appended patch:
> {code}
> bin/TestServer --protocol=json --transport=http --server-type=thread-pool
> --port=9080
> {code}
> And connecting to it with this shell command:
> {code}
> wget --post-data='[' http://localhost:9080
> {code}
> The connection stays up for a long time. Making DOS attacks very easy,
> because at some point the server runs out of available client connections.
> The second appended patch fixes the issue in TConnectedClient.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
