]> git.ipfire.org Git - thirdparty/bind9.git/commit
Make max number of HTTP/2 streams configurable
authorArtem Boldariev <artem@boldariev.com>
Tue, 18 May 2021 09:03:58 +0000 (12:03 +0300)
committerArtem Boldariev <artem@boldariev.com>
Fri, 16 Jul 2021 08:50:22 +0000 (11:50 +0300)
commit590e8e0b86492cd251ffac99c5d790d230d85535
treeab06a1c32b80e39fb81010408c95f8c840c12773
parent03a557a9bbfb1ef930620d73ae8c0c6c763088be
Make max number of HTTP/2 streams configurable

This commit makes number of concurrent HTTP/2 streams per connection
configurable as a mean to fight DDoS attacks. As soon as the limit is
reached, BIND terminates the whole session.

The commit adds a global configuration
option (http-streams-per-connection) which can be overridden in an
http <name> {...} statement like follows:

http local-http-server {
    ...
    streams-per-connection 100;
    ...
};

For now the default value is 100, which should be enough (e.g. NGINX
uses 128, but it is a full-featured WEB-server). When using lower
numbers (e.g. ~70), it is possible to hit the limit with
e.g. flamethrower.
13 files changed:
bin/named/config.c
bin/named/include/named/globals.h
bin/named/server.c
bin/tests/system/checkconf/good-doh-1.conf
bin/tests/test_server.c
lib/isc/include/isc/netmgr.h
lib/isc/netmgr/http.c
lib/isc/netmgr/netmgr-int.h
lib/isc/tests/doh_test.c
lib/isccfg/namedconf.c
lib/ns/include/ns/listenlist.h
lib/ns/interfacemgr.c
lib/ns/listenlist.c