From 27946a981ff4192f064feb3117567463c137933f Mon Sep 17 00:00:00 2001 From: Dan McGee Date: Mon, 19 Sep 2011 08:10:13 -0500 Subject: Set socket TCP keepalive option on incoming connections If a connected host disappears without our knowledge, as can happen over wireless or a hibernating machine, we continue to hold the port open waiting for messages. Because we never try to send anything down this now-broken pipe, the connection will sit idle taking up a slot in our allowed incoming connections list. If enough of these happen, an unintended Denial of Service takes place, where all connection slots are filled with now-broken, never ending connections. Setting the TCP keepalive option at least allows these to time out after the default two hours, which is sufficient in the non-malicious case. Signed-off-by: Dan McGee --- src/server_socket.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'src/server_socket.c') diff --git a/src/server_socket.c b/src/server_socket.c index 82ad81f12..fc8dbd17a 100644 --- a/src/server_socket.c +++ b/src/server_socket.c @@ -160,12 +160,16 @@ server_socket_in_event(G_GNUC_UNUSED GIOChannel *source, size_t address_length = sizeof(address); int fd = accept_cloexec_nonblock(s->fd, (struct sockaddr*)&address, &address_length); - if (fd >= 0) + if (fd >= 0) { + if (socket_keepalive(fd)) + g_warning("Could not set TCP keepalive option: %s", + g_strerror(errno)); s->parent->callback(fd, (const struct sockaddr*)&address, address_length, get_remote_uid(fd), s->parent->callback_ctx); - else + } else { g_warning("accept() failed: %s", g_strerror(errno)); + } return true; } -- cgit v1.2.3