102
103 wg.Add(1)
104 wgStart.Add(1)
105 server := &http.Server{106 Addr: listener.Address,
107 Handler: mux,
108 }117
118 for _, ip := range ips {
119 address := (&net.TCPAddr{IP: ip, Port: port}).String()
120 s := &http.Server{121 Addr: address,
122 Handler: handler,
123 ErrorLog: httpLogger,Slowloris is a type of denial of service (DoS) attack tool which allows a single machine to take down another machine's web server with minimal bandwidth and side effects on unrelated services and ports.
Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to but never completing the request. Affected servers will keep these connections open, filling their maximum concurrent connection pool and eventually denying additional connection attempts from clients.
It is recommended to have a timeout for connections to prevent such attacks.
Bad practice
package main
import (
"fmt"
"time"
"net/http"
)
func main() {
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
fmt.Fprintf(w, "Hello, %s!", r.URL.Path[1:])
})
server := &http.Server{
Addr: ":1234",
}
err := server.ListenAndServe()
if err != nil {
panic(err)
}
}
Recommended
package main
import (
"fmt"
"time"
"net/http"
)
func main() {
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
fmt.Fprintf(w, "Hello, %s!", r.URL.Path[1:])
})
server := &http.Server{
Addr: ":1234",
ReadHeaderTimeout: 3 * time.Second,
}
err := server.ListenAndServe()
if err != nil {
panic(err)
}
}