mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-07-26 07:06:55 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

QUIC: traffic-based flood detection.

Browse Source 
With this patch, all traffic over a QUIC connection is compared to traffic
over QUIC streams.  As long as total traffic is many times larger than stream
traffic, we consider this to be a flood.
This commit is contained in:
Roman Arutyunyan 2021-10-13 14:41:46 +03:00
parent 434f11bf3f
commit 6e58593a59
2 changed files with 31 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
src/event/quic/ngx_event_quic.c
View File

@ -665,13 +665,17 @@ ngx_quic_close_timer_handler(ngx_event_t *ev)
static ngx_int_t static ngx_int_t
ngx_quic_input(ngx_connection_t *c, ngx_buf_t *b, ngx_quic_conf_t *conf) ngx_quic_input(ngx_connection_t *c, ngx_buf_t *b, ngx_quic_conf_t *conf)
{ {
u_char *p; size_t size;
ngx_int_t rc; u_char *p;
ngx_uint_t good; ngx_int_t rc;
ngx_quic_header_t pkt; ngx_uint_t good;
ngx_quic_header_t pkt;
ngx_quic_connection_t *qc;
good = 0; good = 0;
size = b->last - b->pos;
p = b->pos; p = b->pos;
while (p < b->last) { while (p < b->last) {
@ -736,7 +740,27 @@ ngx_quic_input(ngx_connection_t *c, ngx_buf_t *b, ngx_quic_conf_t *conf)
p = b->pos; p = b->pos;
} }
return good ? NGX_OK : NGX_DECLINED; if (!good) {
return NGX_DECLINED;
}
qc = ngx_quic_get_connection(c);
if (qc) {
qc->received += size;
if ((uint64_t) (c->sent + qc->received) / 8 >
(qc->streams.sent + qc->streams.recv_last) + 1048576)
{
ngx_log_error(NGX_LOG_INFO, c->log, 0, "quic flood detected");
qc->error = NGX_QUIC_ERR_NO_ERROR;
qc->error_reason = "QUIC flood detected";
return NGX_ERROR;
}
}
return NGX_OK;
} }

2
src/event/quic/ngx_event_quic_connection.h
View File

@ -236,6 +236,8 @@ struct ngx_quic_connection_s {
ngx_quic_streams_t streams; ngx_quic_streams_t streams;
ngx_quic_congestion_t congestion; ngx_quic_congestion_t congestion;
off_t received;
ngx_uint_t error; ngx_uint_t error;
enum ssl_encryption_level_t error_level; enum ssl_encryption_level_t error_level;
ngx_uint_t error_ftype; ngx_uint_t error_ftype;