How to avoid Slowloris DoS Attack?

[josecelano]

Summary

Relates to: #1383

I'm trying to set a timeout for the time the server keeps a connection open while waiting for the client to start sending a request.

IMPORTANT: it's NOT a timeout for:

• The time receiving the request headers (after the client starts sending the headers)
• The time processing the request (because it takes too long)
• The time building the response body.

I've created a repo to reproduce the problem with a detailed description:

https://github.com/josecelano/axum-server-timeout

axum version

0.7.5

[jplatte]

There is an example for driving TCP connection acceptance and HTTP message handling yourself here, you can probably go from there and insert timeouts?

I suppose we could add support for that kind of thing to axum::serve, do you know of other web server frameworks that offer functionality like that?

[josecelano]

Hi @jplatte, it seems that ActicxWeb offers that functionality:

https://docs.rs/actix-web/latest/actix_web/struct.HttpServer.html#method.client_request_timeout

However, it's still not clear to me if that timeout is:

1. The period from when the connection is established until all the headers for the first request have been received. Or ...
2. The period from when the connection is established until the server receives headers from the client for the first request.

I guess it does not matter. In the end, the server closes the connection if the first request (after opening the connection) is not finished in 5 seconds (the default).

In my example:

https://github.com/josecelano/axum-server-timeout

I get this output:

// The clients connects to the server
Connected to the server: http://127.0.0.1:3000!

// The client does nothing for 15 seconds
Sleeping 15 seconds without sending any requests ...

// The clients send a valid request (first request), and the response is a HTTP/1.1 408 Request Timeout
Send request ... response size: 107 bytes
HTTP/1.1 408 Request Timeout
content-length: 0
connection: close
date: Thu, 18 Apr 2024 18:35:49 GMT

// The client tries to send another "slow" request (second request), but the connection is already closed.
thread 'main' panicked at examples/client.rs:43:14:
called `Result::unwrap()` on an `Err` value: Os { code: 32, kind: BrokenPipe, message: "Broken pipe" }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

There is something I don't understand that I will ask about in the ActixWeb repo. It looks like the connection is not dropped immediately because the first request receives a response. If ActixWeb closes the connection after 5 seconds, the first request should panic like the second, and there is no way to send a 408 response back to the client. I guess ACtixWeb doesn't close the connection immediately, but it checks in the first request if the timeout has been reached and replies immediately with the 408. If that's the case, this solution would not avoid Slowloris DoS Attack. The attacker only has to open connections without sending anything.

[josecelano]

I've just asked on the AxtibWeb repo how the exact behaviour is.