diff options
| author | Roman Arutyunyan <arut@nginx.com> | 2021-10-13 14:46:51 +0300 |
|---|---|---|
| committer | Roman Arutyunyan <arut@nginx.com> | 2021-10-13 14:46:51 +0300 |
| commit | da28a4c6267b8b29d9188f89ab8fad6de08ea688 (patch) | |
| tree | 8f01b5a580066e7e222504737bf4e45c74ddb763 /src | |
| parent | 6e58593a593804cfad04a8ddbea086fec1872ef0 (diff) | |
| download | nginx-da28a4c6267b8b29d9188f89ab8fad6de08ea688.tar.gz nginx-da28a4c6267b8b29d9188f89ab8fad6de08ea688.zip | |
QUIC: limited the total number of frames.
Exceeding 10000 allocated frames is considered a flood.
Diffstat (limited to 'src')
| -rw-r--r-- | src/event/quic/ngx_event_quic_connection.h | 2 | ||||
| -rw-r--r-- | src/event/quic/ngx_event_quic_frames.c | 8 |
2 files changed, 7 insertions, 3 deletions
diff --git a/src/event/quic/ngx_event_quic_connection.h b/src/event/quic/ngx_event_quic_connection.h index b58e9f586..9f3cb2cd0 100644 --- a/src/event/quic/ngx_event_quic_connection.h +++ b/src/event/quic/ngx_event_quic_connection.h @@ -228,8 +228,8 @@ struct ngx_quic_connection_s { ngx_chain_t *free_bufs; ngx_buf_t *free_shadow_bufs; -#ifdef NGX_QUIC_DEBUG_ALLOC ngx_uint_t nframes; +#ifdef NGX_QUIC_DEBUG_ALLOC ngx_uint_t nbufs; #endif diff --git a/src/event/quic/ngx_event_quic_frames.c b/src/event/quic/ngx_event_quic_frames.c index 438565858..8d9fe24c2 100644 --- a/src/event/quic/ngx_event_quic_frames.c +++ b/src/event/quic/ngx_event_quic_frames.c @@ -38,18 +38,22 @@ ngx_quic_alloc_frame(ngx_connection_t *c) "quic reuse frame n:%ui", qc->nframes); #endif - } else { + } else if (qc->nframes < 10000) { frame = ngx_palloc(c->pool, sizeof(ngx_quic_frame_t)); if (frame == NULL) { return NULL; } -#ifdef NGX_QUIC_DEBUG_ALLOC ++qc->nframes; +#ifdef NGX_QUIC_DEBUG_ALLOC ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic alloc frame n:%ui", qc->nframes); #endif + + } else { + ngx_log_error(NGX_LOG_INFO, c->log, 0, "quic flood detected"); + return NULL; } ngx_memzero(frame, sizeof(ngx_quic_frame_t)); |