diff options
| author | Roman Arutyunyan <arut@nginx.com> | 2021-10-07 13:22:42 +0300 |
|---|---|---|
| committer | Roman Arutyunyan <arut@nginx.com> | 2021-10-07 13:22:42 +0300 |
| commit | 434f11bf3f4c9c8466a946c775441ecd6f768c13 (patch) | |
| tree | 4b60637010e15bf84d539d2d027a31deddc1f297 /src/http/v3/ngx_http_v3.h | |
| parent | 0c33e484a4333fe2a343baf3aeefae3212534db3 (diff) | |
| download | nginx-434f11bf3f4c9c8466a946c775441ecd6f768c13.tar.gz nginx-434f11bf3f4c9c8466a946c775441ecd6f768c13.tar.bz2 | |
HTTP/3: traffic-based flood detection.
With this patch, all traffic over HTTP/3 bidi and uni streams is counted in
the h3c->total_bytes field, and payload traffic is counted in the
h3c->payload_bytes field. As long as total traffic is many times larger than
payload traffic, we consider this to be a flood.
Request header traffic is counted as if all fields are literal. Response
header traffic is counted as is.
Diffstat (limited to 'src/http/v3/ngx_http_v3.h')
| -rw-r--r-- | src/http/v3/ngx_http_v3.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/http/v3/ngx_http_v3.h b/src/http/v3/ngx_http_v3.h index 9076b6ff5..53f38a7f2 100644 --- a/src/http/v3/ngx_http_v3.h +++ b/src/http/v3/ngx_http_v3.h @@ -128,6 +128,9 @@ struct ngx_http_v3_session_s { uint64_t max_push_id; uint64_t goaway_push_id; + off_t total_bytes; + off_t payload_bytes; + ngx_uint_t goaway; /* unsigned goaway:1; */ ngx_connection_t *known_streams[NGX_HTTP_V3_MAX_KNOWN_STREAM]; @@ -136,6 +139,7 @@ struct ngx_http_v3_session_s { void ngx_http_v3_init(ngx_connection_t *c); ngx_int_t ngx_http_v3_init_session(ngx_connection_t *c); +ngx_int_t ngx_http_v3_check_flood(ngx_connection_t *c); ngx_int_t ngx_http_v3_read_request_body(ngx_http_request_t *r); ngx_int_t ngx_http_v3_read_unbuffered_request_body(ngx_http_request_t *r); |