mirror of
https://github.com/coredns/coredns.git
synced 2025-12-19 16:45:11 -05:00
Add configurable resource limits to prevent potential DoS vectors via connection/stream exhaustion on gRPC, HTTPS, and HTTPS/3 servers. New configuration plugins: - grpc_server: configure max_streams, max_connections - https: configure max_connections - https3: configure max_streams Changes: - Use netutil.LimitListener for connection limiting - Use gRPC MaxConcurrentStreams and message size limits - Add QUIC MaxIncomingStreams for HTTPS/3 stream limiting - Set secure defaults: 256 max streams, 200 max connections - Setting any limit to 0 means unbounded/fallback to previous impl Defaults are applied automatically when plugins are omitted from config. Includes tests and integration tests. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
64 lines
1.3 KiB
Go
64 lines
1.3 KiB
Go
package https3
|
|
|
|
import (
|
|
"strconv"
|
|
|
|
"github.com/coredns/caddy"
|
|
"github.com/coredns/coredns/core/dnsserver"
|
|
"github.com/coredns/coredns/plugin"
|
|
)
|
|
|
|
func init() {
|
|
caddy.RegisterPlugin("https3", caddy.Plugin{
|
|
ServerType: "dns",
|
|
Action: setup,
|
|
})
|
|
}
|
|
|
|
func setup(c *caddy.Controller) error {
|
|
err := parseDOH3(c)
|
|
if err != nil {
|
|
return plugin.Error("https3", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func parseDOH3(c *caddy.Controller) error {
|
|
config := dnsserver.GetConfig(c)
|
|
|
|
// Skip the "https3" directive itself
|
|
c.Next()
|
|
|
|
// Get any arguments on the "https3" line
|
|
args := c.RemainingArgs()
|
|
if len(args) > 0 {
|
|
return c.ArgErr()
|
|
}
|
|
|
|
// Process all nested directives in the block
|
|
for c.NextBlock() {
|
|
switch c.Val() {
|
|
case "max_streams":
|
|
args := c.RemainingArgs()
|
|
if len(args) != 1 {
|
|
return c.ArgErr()
|
|
}
|
|
val, err := strconv.Atoi(args[0])
|
|
if err != nil {
|
|
return c.Errf("invalid max_streams value '%s': %v", args[0], err)
|
|
}
|
|
if val < 0 {
|
|
return c.Errf("max_streams must be a non-negative integer: %d", val)
|
|
}
|
|
if config.MaxHTTPS3Streams != nil {
|
|
return c.Err("max_streams already defined for this server block")
|
|
}
|
|
config.MaxHTTPS3Streams = &val
|
|
default:
|
|
return c.Errf("unknown property '%s'", c.Val())
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|