Problem - Kevin Tafuro

13.8 Guarding Against Creating Too Many
Network Sockets
Problem
You need to limit the number of network sockets that your program can create.
Solution
Limiting the number of sockets that can be created in an application is a good way to
mitigate potential denial of service attacks by preventing an attacker from creating
too many open sockets for your program to be able to handle. Imposing a limit on
sockets is a simple matter of maintaining a count of the number of sockets that have
been created so far. To do this, you will need to appropriately wrap three socket
functions. The first two functions that need to be wrapped, socket( ) and accept( ),
are used to obtain new socket descriptors, and they should be modified to increment
the number of sockets when they’re successful. The third function, close( )
(closesocket( ) on Windows), is used to dispose of an existing socket descriptor, and
it should be modified to decrement the number of sockets when it’s successful.
Discussion
To limit the number of sockets that can be created, the first step is to call spc_
socketpool_init( ) to initialize the socket pool code. On Unix, this does nothing, but
it is required on Windows to initialize two synchronization objects. Once the socket
pool code is initialized, the next step is to call spc_socketpool_setlimit( ) with the
maximum number of sockets to allow. In our implementation, any limit less than or
equal to zero disables limiting sockets but causes them still to be counted. We have
written the code to be thread-safe and to allow the wrapped functions to block when
no sockets are available. If the limit is adjusted to allow more sockets when the old
limit has already been reached, we cause all threads waiting for sockets to be awakened
by signaling a condition object using pthread_cond_broadcast( ) on Unix or
PulseEvent( ) on Windows.
#include
#include
#ifndef WIN32
#include
#include
#else
#include
#include
#endif
#ifndef WIN32
724 | Chapter 13: Other Topics
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.