diff options
| author | Ruslan Ermilov <ru@nginx.com> | 2018-11-06 16:29:49 +0300 |
|---|---|---|
| committer | Ruslan Ermilov <ru@nginx.com> | 2018-11-06 16:29:49 +0300 |
| commit | 60b93594cca9cb5d63f26e724c458ccb380ac540 (patch) | |
| tree | 05dfffbc156ab8c2995037279f1dee7b1396fd85 /src/http/modules/ngx_http_grpc_module.c | |
| parent | 8ec4146e1aad3a4fc0b19a024f8ef3516791e30c (diff) | |
| download | nginx-60b93594cca9cb5d63f26e724c458ccb380ac540.tar.gz nginx-60b93594cca9cb5d63f26e724c458ccb380ac540.zip | |
HTTP/2: limit the number of idle state switches.
An attack that continuously switches HTTP/2 connection between
idle and active states can result in excessive CPU usage.
This is because when a connection switches to the idle state,
all of its memory pool caches are freed.
This change limits the maximum allowed number of idle state
switches to 10 * http2_max_requests (i.e., 10000 by default).
This limits possible CPU usage in one connection, and also
imposes a limit on the maximum lifetime of a connection.
Initially reported by Gal Goldshtein from F5 Networks.
Diffstat (limited to 'src/http/modules/ngx_http_grpc_module.c')
0 files changed, 0 insertions, 0 deletions