2202f6d · typeable/wai

git.iko.soy/typeable/wai

Merge pull request #418 from mfine/mfine-slowloris-size

Configurable Slowloris size

commit2202f6d77960e4f6142388cb957e06f45e275ab9 authorMichael Snoyman <michael@snoyman.com> dateWed 5 Aug 2015, 12:26 (11 years ago) parente3fd9a2 d072523

4 files changed+18−6

compare with master

unifiedsplit

warp/Network/Wai/Handler/Warp.hs+7 warp/Network/Wai/Handler/Warp/Internal.hs+2−2 warp/Network/Wai/Handler/Warp/Run.hs+4−4 warp/Network/Wai/Handler/Warp/Settings.hs+5

warp/Network/Wai/Handler/Warp.hs+7

@@ -64,6 +64,7 @@ module Network.Wai.Handler.Warp (

6464 , setProxyProtocolNone

6565 , setProxyProtocolRequired

6666 , setProxyProtocolOptional

67+ , setSlowlorisSize

6768 -- ** Getters

6869 , getPort

6970 , getHost

@@ -338,6 +339,12 @@ setProxyProtocolRequired y = y { settingsProxyProtocol = ProxyProtocolRequired }

338339setProxyProtocolOptional :: Settings -> Settings

339340setProxyProtocolOptional y = y { settingsProxyProtocol = ProxyProtocolOptional }

340341

342+-- | Size in bytes read to prevent Slowloris protection. Default value: 2048

343+--

344+-- Since 3.1.2

345+setSlowlorisSize :: Int -> Settings -> Settings

346+setSlowlorisSize x y = y { settingsSlowlorisSize = x }

347+

341348-- | Explicitly pause the slowloris timeout.

342349--

343350-- This is useful for cases where you partially consume a request body. For

warp/Network/Wai/Handler/Warp/Internal.hs+2−2

@@ -45,8 +45,8 @@ module Network.Wai.Handler.Warp.Internal (

4545 --

4646 -- * When all request headers are read, the timeout is tickled.

4747 --

48− -- * Every time at least 2048 bytes of the request body are read, the timeout

49− -- is tickled.

48+ -- * Every time at least the slowloris size settings number of bytes of the request

49+ -- body are read, the timeout is tickled.

5050 --

5151 -- * The timeout is paused while executing user code. This will apply to both

5252 -- the application itself, and a ResponseSource response. The timeout is

warp/Network/Wai/Handler/Warp/Run.hs+4−4

@@ -314,7 +314,7 @@ serveConnection conn ii origAddr transport settings app = do

314314 http2 conn ii origAddr transport settings recvN app

315315 else do

316316 istatus <- newIORef False

317− src <- mkSource (wrappedRecv conn th istatus)

317+ src <- mkSource (wrappedRecv conn th istatus (settingsSlowlorisSize settings))

318318 writeIORef istatus True

319319 leftoverSource src bs

320320 addr <- getProxyProtocolAddr src

@@ -470,12 +470,12 @@ flushBody src =

470470 | toRead' >= 0 -> loop toRead'

471471 | otherwise -> return False

472472

473−wrappedRecv :: Connection -> T.Handle -> IORef Bool -> IO ByteString

474−wrappedRecv Connection { connRecv = recv } th istatus = do

473+wrappedRecv :: Connection -> T.Handle -> IORef Bool -> Int -> IO ByteString

474+wrappedRecv Connection { connRecv = recv } th istatus slowlorisSize = do

475475 bs <- recv

476476 unless (S.null bs) $ do

477477 writeIORef istatus True

478− when (S.length bs >= 2048) $ T.tickle th

478+ when (S.length bs >= slowlorisSize) $ T.tickle th

479479 return bs

480480

481481-- Copied from: https://github.com/mzero/plush/blob/master/src/Plush/Server/Warp.hs

warp/Network/Wai/Handler/Warp/Settings.hs+5

@@ -89,6 +89,10 @@ data Settings = Settings

8989 -- ^ Specify usage of the PROXY protocol.

9090 --

9191 -- Since 3.0.5.

92+ , settingsSlowlorisSize :: Int

93+ -- ^ Size of bytes read to prevent Slowloris protection. Default value: 2048

94+ --

95+ -- Since 3.1.2.

9296 }

9397

9498-- | Specify usage of the PROXY protocol.

@@ -119,6 +123,7 @@ defaultSettings = Settings

119123 , settingsServerName = S8.pack $ "Warp/" ++ showVersion Paths_warp.version

120124 , settingsMaximumBodyFlush = Just 8192

121125 , settingsProxyProtocol = ProxyProtocolNone

126+ , settingsSlowlorisSize = 2048

122127 }

123128

124129-- | Apply the logic provided by 'defaultOnException' to determine if an