From: Frédéric Lécaille Date: Wed, 15 Nov 2023 15:06:21 +0000 (+0100) Subject: DOC: proxy: Add "handshake" timeout documentation. X-Git-Tag: v2.9-dev10~32 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=957085e85deee6998abf86baa54d6ff19e101f09;p=thirdparty%2Fhaproxy.git DOC: proxy: Add "handshake" timeout documentation. Document the "handshake" timeout new setting available one frontend side. This should at least be helpful for QUIC client connections to prevent an attacker from refreshing plenty of connections without completing the handshake step, leading haproxy to consume memory for nothing. --- diff --git a/doc/configuration.txt b/doc/configuration.txt index 0d23c353b0..8c81bd95ab 100644 --- a/doc/configuration.txt +++ b/doc/configuration.txt @@ -4610,6 +4610,7 @@ timeout check X - X X timeout client X X X - timeout client-fin X X X - timeout connect X - X X +timeout handshake X X X - timeout http-keep-alive X X X X timeout http-request X X X X timeout queue X - X X @@ -14456,6 +14457,19 @@ timeout connect See also: "timeout check", "timeout queue", "timeout server", "timeout tarpit". +timeout handshake + Set the maximum time to wait for a client TLS handshake to complete. This is + usable both for TCP and QUIC connections. + May be used in sections : defaults | frontend | listen | backend + yes | yes | yes | no + Arguments : + is the timeout value specified in milliseconds by default, but + can be in any other unit if the number is suffixed by the unit, + as explained at the top of this document. + + If this handshake timeout is not set, this is the client timeout which is used + in place. + timeout http-keep-alive Set the maximum allowed time to wait for a new HTTP request to appear May be used in sections : defaults | frontend | listen | backend