Question

For work I have written a specialized HTTP server which only performs 301/302/Frame redirections for web sites. Recently, some nefarious clients have been intentionally opening sockets and writing one character every 500 milliseconds in order to defeat my TCP socket timeout. Then they keep the socket open indefinitely and have multiple clients doing the same thing in a distributed denial of service. This eventually exhausts the thread pool which handles the TCP connections. How would you write your code to make it less susceptible to this sort of bad behavior? Here’s my socket accept code:

while (true) {
    // Blocks while waiting for a new connection
    log.debug("Blocking while waiting for a new connection.") ;
    try {
        Socket server = httpServer.accept() ; 

        // After receiving a new connection, set the SO_LINGER and SO_TIMEOUT options
        server.setReuseAddress(true) ;
        server.setSoTimeout(timeout) ;
        server.setSoLinger(true, socketTimeout) ;

        // Hand off the new socket connection to a worker thread
        threadPool.execute(new Worker(cache, server, requests, geoIp)) ;
    } catch (IOException e) {
        log.error("Unable to accept socket connection.", e) ;
        continue ;
    }
}

timeout and socketTimeout are currently set to 500 milliseconds.

Answer 1

Start closing sockets after a certain time has passed. If a socket has stayed open too long just close it down. You could do this in two ways:

You could also put a time limit on how long the client takes to send you a request. If they don’t sustain a certain level of throughput close em. That can be pretty easy to do in your read loop when your thread is reading the request by adding a System.currentTimeInMillis() at the start and compare to where you are as you loop. If it drifts past a certain limit they are shutdown and dropped.

An alternative idea to this idea is possibly not reject them but let your thread return to the pool, but put the socket on a stack to watch. Let the bytes pile up and after they reached a certain size you can them pass them to a thread in the pool to process. This the hybrid approach to cut em off vs. maybe they aren’t bad but slow.

Another way to handle that is watch how long a thread has been working on a request, and if it’s not finished within a time limit close the underlying socket. Then the thread will get a SocketException and it can shutdown and clean up.

Here are some other ideas that mostly involve using outside hardware like firewalls, load balancers, etc.

https://security.stackexchange.com/questions/114/what-techniques-do-advanced-firewalls-use-to-protect-againt-dos-ddos/792#792