[master] Add patch to limit the value of an fd we accept for a connection.

By limiting the highest value we accept for an fd we limit the number
of connections.

diff --git a/RELNOTES b/RELNOTES
index 84fcc49d8898360491cc4d33e7ac446402df64ae..47e303039e5afebab0f3a6d48ede4d07c3f16818 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -254,6 +254,10 @@ by Eric Young (eay@cryptsoft.com).
   escapes, and hex - unquoted, colon separated hex digits.
   [ISC-Busg #26378]
 
+! Add an option in site.h to limit the number of failover and control
+  connections the server will accept.  By default this is 200.
+  [ISC-Bugs #41845]
+
                        Changes since 4.3.3b1
 
 - None

diff --git a/includes/site.h b/includes/site.h
index 944dbefc7b6994ec71e929e4840871b5b5e9d116..1f4407f4254e0e12a85b7f183a3d4ad6ce43372a 100644 (file)
--- a/includes/site.h
+++ b/includes/site.h
@@ -312,6 +312,12 @@
    default. */
 #define PRINT_SPECIFIC_CL_ERRORS
 
+/* Limit the value of a file descriptor the serve will use
+   when accepting a connecting request.  This can be used to
+   limit the number of TCP connections that the server will
+   allow at one time.  A value of 0 means there is no limit.*/
+#define MAX_FD_VALUE 200
+
 /* Include definitions for various options.  In general these
    should be left as is, but if you have already defined one
    of these and prefer your definition you can comment the 

diff --git a/omapip/listener.c b/omapip/listener.c
index 8bdcdbd7ffe9049518491841f932dec16ca6c5bf..61473cf5fbf26d13f39a137b5180692c98177014 100644 (file)
--- a/omapip/listener.c
+++ b/omapip/listener.c
@@ -3,7 +3,7 @@
    Subroutines that support the generic listener object. */
 
 /*
- * Copyright (c) 2012,2014 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2012,2014,2016 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 2004,2007,2009 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 1999-2003 by Internet Software Consortium
  *
@@ -233,7 +233,12 @@ isc_result_t omapi_accept (omapi_object_t *h)
                        return ISC_R_NORESOURCES;
                return ISC_R_UNEXPECTED;
        }
-       
+
+       if ((MAX_FD_VALUE != 0) && (socket > MAX_FD_VALUE)) {
+               close(socket);
+               return (ISC_R_NORESOURCES);
+       }
+
 #if defined (TRACING)
        /* If we're recording a trace, remember the connection. */
        if (trace_record ()) {