Skip to content

http.ListenAndServe denial of service #1891

@gopherbot

Description

@gopherbot

by binary@fiane.dyndns.org:

What steps will reproduce the problem?

http.ListenAndServer seems to be quite easy to DOS.

The following example:

package main

import (
    "http"
    "log"
    "runtime"
)

func main() {

    http.Handle("/", http.FileServer(".",""))
    err := http.ListenAndServe(":12345", nil)
    if err != nil {
        log.Fatalln("ListenAndServe: ", err.String())
    }
}

will eventually bail out and exit the http server with:

2011/05/27 00:29:51 ListenAndServe:  accept tcp [::]:12345: too many open files 

Can be produced by running this bash piece

   for i in {0...20000} ; do nc localhost 12345 & done


http.Serve() likely needs to be more lenient on what errors it considers fatal on
accept(). (Note that on linux, fast detected client errors can also be returned from
accept() , such as ENETDOWN, EPROTO, ENOPROTOOPT, EHOSTDOWN, ENONET, EHOSTUNREACH,
EOPNOTSUPP, and ENETUNREACH)

Which compiler are you using (5g, 6g, 8g, gccgo)?
8g

Which operating system are you using?
Linux(Fedora 14)

Which revision are you using?  (hg identify)
f1519be2d0e9 tip

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions