Klaus Demo nginx / b5802db
HTTP/2: limit the number of idle state switches. An attack that continuously switches HTTP/2 connection between idle and active states can result in excessive CPU usage. This is because when a connection switches to the idle state, all of its memory pool caches are freed. This change limits the maximum allowed number of idle state switches to 10 * http2_max_requests (i.e., 10000 by default). This limits possible CPU usage in one connection, and also imposes a limit on the maximum lifetime of a connection. Initially reported by Gal Goldshtein from F5 Networks. Ruslan Ermilov 3 years ago
2 changed file(s) with 11 addition(s) and 3 deletion(s). Raw diff Collapse all Expand all
+10
-3
src/http/v2/ngx_http_v2.c less more
44804480
44814481 #endif
44824482
4483 h2scf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,
4484 ngx_http_v2_module);
4485
4486 if (h2c->idle++ > 10 * h2scf->max_requests) {
4487 ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
4488 "http2 flood detected");
4489 ngx_http_v2_finalize_connection(h2c, NGX_HTTP_V2_NO_ERROR);
4490 return;
4491 }
4492
44834493 c->destroyed = 0;
44844494 ngx_reusable_connection(c, 0);
4485
4486 h2scf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,
4487 ngx_http_v2_module);
44884495
44894496 h2c->pool = ngx_create_pool(h2scf->pool_size, h2c->connection->log);
44904497 if (h2c->pool == NULL) {
+1
-0
src/http/v2/ngx_http_v2.h less more
120120
121121 ngx_uint_t processing;
122122 ngx_uint_t frames;
123 ngx_uint_t idle;
123124
124125 ngx_uint_t pushing;
125126 ngx_uint_t concurrent_pushes;