ah: reuse at end of transaction has no timeout
If we complete a transaction but end up keeping the ah, we must force
a timeout on it. Otherwise a bad bot could keep the socket open and
exhaust the ah pool.
diff --git a/lib/server.c b/lib/server.c
index 16e3808..6e7c8b0 100644
--- a/lib/server.c
+++ b/lib/server.c
@@ -1889,8 +1889,17 @@
return 1;
}
#endif
- } else
+ } else {
lws_header_table_reset(wsi, 1);
+ /*
+ * If we kept the ah, we should restrict the amount
+ * of time we are willing to keep it. Otherwise it
+ * will be bound the whole time the connection remains
+ * open.
+ */
+ lws_set_timeout(wsi, PENDING_TIMEOUT_HOLDING_AH,
+ wsi->vhost->keepalive_timeout);
+ }
}
/* If we're (re)starting on headers, need other implied init */
