mirror of
https://github.com/coredns/coredns.git
synced 2025-12-20 09:05:14 -05:00
0d8cbb1a6b
Add configurable resource limits to prevent potential DoS vectors via connection/stream exhaustion on gRPC, HTTPS, and HTTPS/3 servers. New configuration plugins: - grpc_server: configure max_streams, max_connections - https: configure max_connections - https3: configure max_streams Changes: - Use netutil.LimitListener for connection limiting - Use gRPC MaxConcurrentStreams and message size limits - Add QUIC MaxIncomingStreams for HTTPS/3 stream limiting - Set secure defaults: 256 max streams, 200 max connections - Setting any limit to 0 means unbounded/fallback to previous impl Defaults are applied automatically when plugins are omitted from config. Includes tests and integration tests. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
64 lines
1.3 KiB
Go
64 lines
1.3 KiB
Go
package https
|
|
|
|
import (
|
|
"strconv"
|
|
|
|
"github.com/coredns/caddy"
|
|
"github.com/coredns/coredns/core/dnsserver"
|
|
"github.com/coredns/coredns/plugin"
|
|
)
|
|
|
|
func init() {
|
|
caddy.RegisterPlugin("https", caddy.Plugin{
|
|
ServerType: "dns",
|
|
Action: setup,
|
|
})
|
|
}
|
|
|
|
func setup(c *caddy.Controller) error {
|
|
err := parseDOH(c)
|
|
if err != nil {
|
|
return plugin.Error("https", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func parseDOH(c *caddy.Controller) error {
|
|
config := dnsserver.GetConfig(c)
|
|
|
|
// Skip the "https" directive itself
|
|
c.Next()
|
|
|
|
// Get any arguments on the "https" line
|
|
args := c.RemainingArgs()
|
|
if len(args) > 0 {
|
|
return c.ArgErr()
|
|
}
|
|
|
|
// Process all nested directives in the block
|
|
for c.NextBlock() {
|
|
switch c.Val() {
|
|
case "max_connections":
|
|
args := c.RemainingArgs()
|
|
if len(args) != 1 {
|
|
return c.ArgErr()
|
|
}
|
|
val, err := strconv.Atoi(args[0])
|
|
if err != nil {
|
|
return c.Errf("invalid max_connections value '%s': %v", args[0], err)
|
|
}
|
|
if val < 0 {
|
|
return c.Errf("max_connections must be a non-negative integer: %d", val)
|
|
}
|
|
if config.MaxHTTPSConnections != nil {
|
|
return c.Err("max_connections already defined for this server block")
|
|
}
|
|
config.MaxHTTPSConnections = &val
|
|
default:
|
|
return c.Errf("unknown property '%s'", c.Val())
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|