DOC: proxy: Add "handshake" timeout documentation.

Document the "handshake" timeout new setting available one frontend side.
This should at least be helpful for QUIC client connections to prevent
an attacker from refreshing plenty of connections without completing
the handshake step, leading haproxy to consume memory for nothing.

diff --git a/doc/configuration.txt b/doc/configuration.txt
index 0d23c353b0aff2ecc4b362fd4b88e37618b2e90c..8c81bd95ab902c56e78611a2e8ad5a6adc1e87f0 100644 (file)
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -4610,6 +4610,7 @@ timeout check                             X          -         X         X
 timeout client                            X          X         X         -
 timeout client-fin                        X          X         X         -
 timeout connect                           X          -         X         X
+timeout handshake                         X          X         X         -
 timeout http-keep-alive                   X          X         X         X
 timeout http-request                      X          X         X         X
 timeout queue                             X          -         X         X
@@ -14456,6 +14457,19 @@ timeout connect <timeout>
   See also: "timeout check", "timeout queue", "timeout server", "timeout tarpit".
 
 
+timeout handshake <timeout>
+  Set the maximum time to wait for a client TLS handshake to complete. This is
+  usable both for TCP and QUIC connections.
+  May be used in sections :   defaults | frontend | listen | backend
+                                 yes   |    yes   |   yes  |   no
+  Arguments :
+    <timeout> is the timeout value specified in milliseconds by default, but
+              can be in any other unit if the number is suffixed by the unit,
+              as explained at the top of this document.
+
+  If this handshake timeout is not set, this is the client timeout which is used
+  in place.
+
 timeout http-keep-alive <timeout>
   Set the maximum allowed time to wait for a new HTTP request to appear
   May be used in sections :   defaults | frontend | listen | backend