diff options
| author | Ruslan Ermilov <ru@nginx.com> | 2018-11-06 16:29:49 +0300 |
|---|---|---|
| committer | Ruslan Ermilov <ru@nginx.com> | 2018-11-06 16:29:49 +0300 |
| commit | 60b93594cca9cb5d63f26e724c458ccb380ac540 (patch) | |
| tree | 05dfffbc156ab8c2995037279f1dee7b1396fd85 /src/http/v2/ngx_http_v2.h | |
| parent | 8ec4146e1aad3a4fc0b19a024f8ef3516791e30c (diff) | |
| download | nginx-60b93594cca9cb5d63f26e724c458ccb380ac540.tar.gz nginx-60b93594cca9cb5d63f26e724c458ccb380ac540.tar.bz2 | |
HTTP/2: limit the number of idle state switches.
An attack that continuously switches HTTP/2 connection between
idle and active states can result in excessive CPU usage.
This is because when a connection switches to the idle state,
all of its memory pool caches are freed.
This change limits the maximum allowed number of idle state
switches to 10 * http2_max_requests (i.e., 10000 by default).
This limits possible CPU usage in one connection, and also
imposes a limit on the maximum lifetime of a connection.
Initially reported by Gal Goldshtein from F5 Networks.
Diffstat (limited to 'src/http/v2/ngx_http_v2.h')
| -rw-r--r-- | src/http/v2/ngx_http_v2.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h index e8eaebb25..bec22160e 100644 --- a/src/http/v2/ngx_http_v2.h +++ b/src/http/v2/ngx_http_v2.h @@ -121,6 +121,7 @@ struct ngx_http_v2_connection_s { ngx_uint_t processing; ngx_uint_t frames; + ngx_uint_t idle; ngx_uint_t pushing; ngx_uint_t concurrent_pushes; |