Setting a Timeout on incorrectly structured Multipart msg's

[Mustafa Sezgin <ms...@aconex.com>]

Hi all,

 

We are setting up some Rest services which will be accepting multi part
msgs. Something I have noticed is that there is a potential for a DoS
attack in the even that multipart msgs do not end with a proper boundary.
It seems the connection remains used for a long period of time. Is there
anyway to tell CXF to timeout if no activity has occurred on the
connection after a certain period of time or is this something that CXF
leaves to the container or OS being used?

 

Thanks

 

Mustafa

 

Re: Setting a Timeout on incorrectly structured Multipart msg's

[Daniel Kulp <dk...@apache.org>]

On Thu October 8 2009 8:06:48 pm Mustafa Sezgin wrote:
> 
> We are setting up some Rest services which will be accepting multi part
> msgs. Something I have noticed is that there is a potential for a DoS
> attack in the even that multipart msgs do not end with a proper boundary.
> It seems the connection remains used for a long period of time. Is there
> anyway to tell CXF to timeout if no activity has occurred on the
> connection after a certain period of time or is this something that CXF
> leaves to the container or OS being used?

This definitely is something that the servlet container would normally have to 
provide.   From our standpoint (and servlet spec) we just have an input stream 
that we read from.  If it blocks to wait for network IO, that's definitely 
something the servlet container would be dealing with.   :-(


Dan

> 
> 
> 
> Thanks
> 
> 
> 
> Mustafa
> 

-- 
Daniel Kulp
dkulp@apache.org
http://www.dankulp.com/blog

Re: Setting a Timeout on incorrectly structured Multipart msg's

[Sergey Beryozkin <sb...@progress.com>]

Hi

If jetty is being used then you can configure a Jetty Socket connector :

http://svn.apache.org/repos/asf/cxf/trunk/systests/transports/src/test/java/org/apache/cxf/systest/http_jetty/jetty-engine.xml

(see the engine config for port 8081) and set a maxIdleTime property on it

some more info which you might find useful is here :

http://www.nabble.com/Cannot-adjust-jetty-timeout-value.-td17223729.html

hope it helps, Sergey


----- Original Message ----- 
From: "Mustafa Sezgin" <ms...@aconex.com>
To: <us...@cxf.apache.org>
Sent: Friday, October 09, 2009 1:06 AM
Subject: Setting a Timeout on incorrectly structured Multipart msg's


> Hi all,
> 
> 
> 
> We are setting up some Rest services which will be accepting multi part
> msgs. Something I have noticed is that there is a potential for a DoS
> attack in the even that multipart msgs do not end with a proper boundary.
> It seems the connection remains used for a long period of time. Is there
> anyway to tell CXF to timeout if no activity has occurred on the
> connection after a certain period of time or is this something that CXF
> leaves to the container or OS being used?
> 
> 
> 
> Thanks
> 
> 
> 
> Mustafa
> 
> 
> 
>