upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-02-17 01:28:32 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 8
haproxy/src
History
Amaury Denoyelle 278808915b MINOR: quic: reduce half open counters scope 
Accounting is implemented for half open connections which represent QUIC
connections waiting for handshake completion. When reaching a certain
limit, Retry mechanism is automatically activated prior to instantiate
new connections.

The issue with this behavior is that two notions are mixed : QUIC
connection handshake phase and Retry which is mechanism against
amplification attacks. As such, only peer address validation should be
taken into account to activate Retry protection.

This patch chooses to reduce the scope of half_open_conn. Now only
connection waiting to validate the peer address are now accounted for.
Most notably, connections instantiated with a validated Retry token
check are not accounted.

One impact of this patch is that it should prevent to activate Retry
mechanism too early, in particular in case if multiple handshakes are
too slow. Another limitation should be implemented to protect against
this scenario.
2023-11-09 16:23:52 +01:00
..
acl.c MINOR: acl: add acl() sample fetch 2023-08-01 10:49:06 +02:00
action.c MINOR: support for http-request set-timeout client 2023-09-28 08:49:22 +02:00
activity.c MINOR: checks: maintain counters of active checks per thread 2023-09-01 08:26:06 +02:00
applet.c MINOR: stconn: Start to introduce mux-to-mux fast-forwarding notion 2023-10-17 18:51:13 +02:00
arg.c CLEANUP: arg: remove extra check in make_arg_list arg escaping 2022-11-22 16:27:52 +01:00
auth.c MINOR: auth: silence null dereference warning in check_user() 2022-11-24 15:24:02 +01:00
backend.c MINOR: backend: refactor insertion in avail conns tree 2023-10-25 10:33:06 +02:00
base64.c
cache.c MEDIUM: cache: Add "Origin" header to secondary cache key 2023-10-05 10:53:54 +02:00
calltrace.c BUG/MINOR: calltrace: fix 'now' being used in place of 'date' 2023-04-27 18:14:57 +02:00
cbuf.c CLEANUP: pool/tree-wide: remove suffix "_pool" from certain pool names 2022-06-23 11:49:09 +02:00
cfgcond.c MINOR: protocol: move the global reuseport flag to the protocols 2023-04-23 09:46:15 +02:00
cfgdiag.c
cfgparse-global.c MINOR: global: Add an option to disable the zero-copy forwarding 2023-10-17 18:51:13 +02:00
cfgparse-listen.c BUG/MEDIUM: server/log: "mode log" after server keyword causes crash 2023-10-25 11:59:27 +02:00
cfgparse-quic.c MINOR: quic: define quic-socket bind setting 2023-10-03 16:49:26 +02:00
cfgparse-ssl.c BUG/MINOR: ssl: load correctly @system-ca when ca-base is define 2023-10-23 22:03:55 +02:00
cfgparse-tcp.c BUG/MINOR: cfgparse-tcp: leak when re-declaring interface from bind line 2023-06-06 15:15:17 +02:00
cfgparse-unix.c
cfgparse.c MINOR: stktable: stktable_init() sets err_msg on error 2023-11-03 17:30:30 +01:00
channel.c MINOR: tree-wide: Only rely on co_data() to check channel emptyness 2023-10-17 18:51:13 +02:00
check.c BUG/MINOR: tcpcheck: Report hexstring instead of binary one on check failure 2023-10-31 08:02:44 +01:00
chunk.c MEDIUM: init: initialize the trash earlier 2023-09-08 16:25:19 +02:00
cli.c BUG/MEDIUM: master/cli: Pin the master CLI on the first thread of the group 1 2023-09-13 10:26:32 +02:00
clock.c MINOR: clock: provide a function to automatically adjust now_offset 2023-05-17 09:33:54 +02:00
compression.c MINOR: compression/slz: add support for a pure flush of pending bytes 2023-06-30 16:12:36 +02:00
connection.c MINOR: connection: Send out generic, user-defined server TLVs 2023-11-04 04:56:59 +01:00
cpuset.c REORG: cpuset: move parse_cpu_set() and parse_cpumap() to cpuset.c 2023-09-08 16:25:19 +02:00
debug.c DEBUG: pools: detect that malloc_trim() is in progress 2023-10-25 15:48:02 +02:00
dgram.c MINOR: dgram: allow to set rcv/sndbuf for dgram sockets as well 2023-10-18 17:01:19 +02:00
dict.c
dns.c MEDIUM: tree-wide: Change sc API to specify required free space to progress 2023-05-05 15:44:23 +02:00
dynbuf.c DEBUG: pools: always record the caller for uncached allocs as well 2023-09-11 15:19:49 +02:00
eb32sctree.c
eb32tree.c
eb64tree.c
ebimtree.c
ebistree.c
ebmbtree.c
ebpttree.c
ebsttree.c
ebtree.c
errors.c MEDIUM: errors: move the MODE_QUIET test in print_message() 2023-11-09 14:39:11 +01:00
ev_epoll.c MINOR: pollers: only update the local date during busy polling 2022-09-21 09:06:28 +02:00
ev_evports.c MINOR: pollers: only update the local date during busy polling 2022-09-21 09:06:28 +02:00
ev_kqueue.c MINOR: pollers: only update the local date during busy polling 2022-09-21 09:06:28 +02:00
ev_poll.c BUG/MINOR: signals/poller: ensure wakeup from signals 2022-09-09 11:15:22 +02:00
ev_select.c MEDIUM: fd/poller: turn update_mask to group-local IDs 2022-07-15 20:16:30 +02:00
event_hdl.c Revert "MAJOR: import: update mt_list to support exponential back-off" 2023-09-15 17:13:43 +02:00
extcheck.c MINOR: checks: use the lighter PRNG for spread checks 2022-10-12 21:49:30 +02:00
fcgi-app.c MEDIUM: tree-wide: logsrv struct becomes logger 2023-10-13 10:05:06 +02:00
fcgi.c BUG/MAJOR: fcgi: Fix uninitialized reserved bytes 2022-12-09 12:23:14 +01:00
fd.c BUG/MEDIUM: fd: don't wait for tmask to stabilize if we're not in it. 2023-04-13 18:04:46 +02:00
filters.c MINOR: filter: "filter" requires TCP or HTTP mode 2023-10-06 15:34:30 +02:00
fix.c
flt_bwlim.c BUG/MEDIUM: bwlim: Reset analyse expiration date when then channel analyse ends 2023-08-01 11:33:45 +02:00
flt_http_comp.c MINOR: flt_http_comp: "compression" requires TCP or HTTP mode 2023-10-06 15:34:30 +02:00
flt_spoe.c MEDIUM: tree-wide: logsrv struct becomes logger 2023-10-13 10:05:06 +02:00
flt_trace.c BUG/MINOR: trace: show wall-clock date, not internal date in show activity 2023-04-27 18:22:34 +02:00
freq_ctr.c BUG/MEDIUM: freq-ctr: Don't report overshoot for long inactivity period 2023-11-08 16:38:06 +01:00
frontend.c MINOR: frontend: implement a dedicated actconn increment function 2023-10-26 15:18:48 +02:00
h1.c BUG/MEDIUM: h1: Ignore C-L value in the H1 parser if T-E is also set 2023-10-04 15:34:18 +02:00
h1_htx.c MINOR: h1-htx: Declare successful tunnel establishment as bodyless 2023-10-04 15:34:18 +02:00
h2.c MINOR: h2: Set the BODYLESS_RESP flag on the HTX start-line if necessary 2023-10-17 18:51:13 +02:00
h3.c BUG/MINOR: h3: strengthen host/authority header parsing 2023-10-11 14:21:30 +02:00
h3_stats.c MINOR: h3: Add a statistics module for h3 2022-05-30 09:59:26 +02:00
haproxy.c MEDIUM: mworker: -W is mandatory when using -S 2023-11-09 15:07:15 +01:00
hash.c BUILD: hash: use __fallthrough in hash_djb2() 2022-11-14 11:14:02 +01:00
hlua.c MINOR: lua: change tune.lua.log.stderr default from 'on' to 'auto' 2023-10-25 07:49:03 +02:00
hlua_fcn.c Revert "MAJOR: import: update mt_list to support exponential back-off" 2023-09-15 17:13:43 +02:00
hpack-dec.c BUG/CRITICAL: http: properly reject empty http header field names 2023-02-14 08:48:54 +01:00
hpack-enc.c
hpack-huff.c BUG/MEDIUM: hpack: fix incorrect huffman decoding of some control chars 2023-01-26 11:36:39 +01:00
hpack-tbl.c
hq_interop.c BUG/MINOR: hq-interop: simplify parser requirement 2023-10-04 17:32:23 +02:00
http.c MINOR: sample: Add fetcher for getting all cookie names 2023-11-03 09:57:06 +01:00
http_acl.c
http_act.c MINOR: support for http-response set-timeout 2023-10-17 08:27:33 +02:00
http_ana.c MINOR: tree-wide: Only rely on co_data() to check channel emptyness 2023-10-17 18:51:13 +02:00
http_client.c MEDIUM: tree-wide: logsrv struct becomes logger 2023-10-13 10:05:06 +02:00
http_conv.c CLEANUP: assorted typo fixes in the code and comments 2023-04-01 18:33:40 +02:00
http_ext.c BUG/MINOR: http_ext: unhandled ERR_ABORT in proxy_http_parse_7239() 2023-07-06 15:41:17 +02:00
http_fetch.c MINOR: sample: Add fetcher for getting all cookie names 2023-11-03 09:57:06 +01:00
http_htx.c MINOR: http_htx/errors: prevent the use of some keywords when not in tcp/http mode 2023-10-06 15:34:30 +02:00
http_rules.c MINOR: tree-wide: use free_acl_cond() where relevant 2023-05-11 15:37:04 +02:00
htx.c CLEANUP: htx: Properly indent htx_reserve_max_data() function 2023-11-07 10:41:11 +01:00
init.c
jwt.c MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) 2023-03-08 10:43:04 +01:00
lb_chash.c
lb_fas.c
lb_fwlc.c
lb_fwrr.c
lb_map.c
linuxcap.c MEDIUM: capabilities: enable support for Linux capabilities 2023-08-29 11:11:50 +02:00
listener.c MEDIUM: quic: count quic_conn instance for maxconn 2023-10-26 15:35:56 +02:00
log.c CLEANUP: Re-apply xalloc_size.cocci (3) 2023-11-06 20:49:56 +01:00
lru.c
mailers.c MINOR: mailers/hlua: disable email sending from lua 2023-05-05 16:28:32 +02:00
map.c BUG/MEDIUM: pattern: don't trim pools under lock in pat_ref_purge_range() 2023-11-04 07:55:37 +01:00
mjson.c BUILD: mjson: Fix warning about unused variables 2023-05-11 09:22:46 +02:00
mqtt.c
mux_fcgi.c MINOR: backend: refactor insertion in avail conns tree 2023-10-25 10:33:06 +02:00
mux_h1.c BUG/MEDIUM: mux-h1: Exit early if fast-forward is not supported by opposite SC 2023-11-09 15:18:43 +01:00
mux_h2.c MINOR: stconn/mux-h2: Use a iobuf flag to report EOI to consumer side during FF 2023-11-08 21:14:07 +01:00
mux_pt.c BUG/MEDIUM: stconn: Report send activity during mux-to-mux fast-forward 2023-11-07 10:30:01 +01:00
mux_quic.c BUG/MINOR: mux-quic: fix early close if unset client timeout 2023-10-27 17:51:08 +02:00
mworker-prog.c MEDIUM: clock: replace timeval "now" with integer "now_ns" 2023-04-28 16:08:08 +02:00
mworker.c MEDIUM: mworker: display a more accessible message when a worker crash 2023-09-05 15:31:04 +02:00
namespace.c BUG/MINOR: namespace: missing free in netns_sig_stop() 2023-06-14 11:27:29 +02:00
ncbuf.c MINOR: ncbuf: missing malloc checks in standalone code 2023-05-12 09:45:30 +02:00
pattern.c BUG/MEDIUM: pattern: don't trim pools under lock in pat_ref_purge_range() 2023-11-04 07:55:37 +01:00
payload.c MEDIUM: tree-wide: fetches that may return IPV4+IPV6 now return ADDR 2023-07-03 16:32:01 +02:00
peers.c MEDIUM: stktable/peers: "write-to" local table on peer updates 2023-11-03 17:30:30 +01:00
pipe.c
pool.c BUG/MEDIUM: pool: try once to allocate from another bucket if empty 2023-11-08 17:14:03 +01:00
proto_quic.c CLEANUP: Re-apply xalloc_size.cocci (3) 2023-11-06 20:49:56 +01:00
proto_reverse_connect.c MINOR: proto_reverse_connect: use connect timeout 2023-11-08 10:17:43 +01:00
proto_sockpair.c MEDIUM: proto: duplicate receivers marked RX_F_MUST_DUP 2023-04-21 17:41:26 +02:00
proto_tcp.c MINOR: protocol: move the global reuseport flag to the protocols 2023-04-23 09:46:15 +02:00
proto_udp.c MINOR: dgram: allow to set rcv/sndbuf for dgram sockets as well 2023-10-18 17:01:19 +02:00
proto_uxdg.c MINOR: proto_ux: ability to dump ABNS names in error messages 2023-02-23 15:05:05 +01:00
proto_uxst.c MINOR: proto: skip socket setup for duped FDs 2023-04-21 17:41:26 +02:00
protocol.c MINOR: quic+openssl_compat: Do not start without "limited-quic" 2023-08-17 15:44:03 +02:00
proxy.c MINOR: proxy/stktable: add resolve_stick_rule helper function 2023-11-03 17:30:30 +01:00
qmux_http.c MINOR: mux-quic: remove dedicated function to handle standalone FIN 2023-05-12 15:50:30 +02:00
qmux_trace.c MINOR: mux-quic: add flow-control info to minimal trace level 2023-03-22 16:08:54 +01:00
qpack-dec.c BUG/MINOR: mux-quic: fix transport VS app CONNECTION_CLOSE 2023-05-09 18:42:34 +02:00
qpack-enc.c BUG/MINOR: qpack: support bigger prefix-integer encoding 2022-05-30 14:30:05 +02:00
qpack-tbl.c CLEANUP: qpack: properly use the QPACK macros not HPACK ones in debug code 2022-11-24 15:38:26 +01:00
queue.c MEDIUM: clock: replace timeval "now" with integer "now_ns" 2023-04-28 16:08:08 +02:00
quic_ack.c REORG: quic: cleanup traces definition 2023-10-11 14:15:31 +02:00
quic_cc.c CLEANUP: quic: fix headers 2022-10-03 16:25:17 +02:00
quic_cc_cubic.c REORG: quic: cleanup traces definition 2023-10-11 14:15:31 +02:00
quic_cc_newreno.c REORG: quic: cleanup traces definition 2023-10-11 14:15:31 +02:00
quic_cc_nocc.c REORG: quic: cleanup traces definition 2023-10-11 14:15:31 +02:00
quic_cli.c BUG/MINOR: quic: Wrong RTT computation (srtt and rrt_var) 2023-09-05 17:14:51 +02:00
quic_conn.c MINOR: quic: reduce half open counters scope 2023-11-09 16:23:52 +01:00
quic_frame.c MEDIUM: quic: Heavy task mode during handshake 2023-11-09 10:32:31 +01:00
quic_loss.c REORG: quic: cleanup traces definition 2023-10-11 14:15:31 +02:00
quic_openssl_compat.c REORG: quic: cleanup traces definition 2023-10-11 14:15:31 +02:00
quic_rx.c MINOR: quic: reduce half open counters scope 2023-11-09 16:23:52 +01:00
quic_sock.c REORG: quic: cleanup traces definition 2023-10-11 14:15:31 +02:00
quic_ssl.c MINOR: quic: reduce half open counters scope 2023-11-09 16:23:52 +01:00
quic_stats.c MINOR: quic: fix stats naming for flow control BLOCKED frames 2023-05-26 17:17:00 +02:00
quic_stream.c BUG/MINOR: mux-quic: differentiate failure on qc_stream_desc alloc 2023-05-12 16:26:20 +02:00
quic_tls.c MEDIUM: quic: Heavy task mode during handshake 2023-11-09 10:32:31 +01:00
quic_tp.c REORG: quic: cleanup traces definition 2023-10-11 14:15:31 +02:00
quic_trace.c MINOR: quic: Add idle timer task pointer to traces 2023-11-09 10:32:31 +01:00
quic_tx.c BUG/MEDIUM: quic: Avoid some crashes upon TX packet allocation failures 2023-11-09 10:32:31 +01:00
raw_sock.c MEDIUM: raw-sock: Specifiy amount of data to send via snd_pipe callback 2023-10-17 18:51:13 +02:00
regex.c BUG/MINOR: regex: Properly handle PCRE2 lib compiled without JIT support 2022-09-01 19:34:46 +02:00
resolvers.c MEDIUM: resolvers: Stop scheduling resolution during stopping stage 2023-05-17 16:48:33 +02:00
ring.c CLEANUP: ring: rename the ring lock "RING_LOCK" instead of "LOGSRV_LOCK" 2023-09-20 21:38:33 +02:00
sample.c MINOR: sample: Added support for Arrays in sample_conv_json_query in sample.c 2023-10-20 18:42:05 +02:00
server.c CLEANUP: Re-apply xalloc_size.cocci (3) 2023-11-06 20:49:56 +01:00
server_state.c BUG/MINOR: server-state: Avoid warning on 'file not found' 2023-07-21 15:08:27 +02:00
session.c MINOR: connection: prepare init code paths for active reverse 2023-08-24 17:02:37 +02:00
sha1.c
shctx.c
signal.c BUG/MINOR: signals/poller: ensure wakeup from signals 2022-09-09 11:15:22 +02:00
sink.c MINOR: server: introduce "log-bufsize" kw 2023-10-13 10:05:07 +02:00
slz.c IMPORT: slz: implement a synchronous flush() operation 2023-06-30 16:12:36 +02:00
sock.c MINOR: sock: add a function to check for SO_REUSEPORT support at runtime 2023-04-23 09:46:15 +02:00
sock_inet.c MINOR: protocol: move the global reuseport flag to the protocols 2023-04-23 09:46:15 +02:00
sock_unix.c MEDIUM: proto: duplicate receivers marked RX_F_MUST_DUP 2023-04-21 17:41:26 +02:00
ssl_ckch.c MINOR: properly mark the end of the CLI command in error messages 2023-09-04 18:13:43 +02:00
ssl_crtlist.c MINOR: ssl: allow to change the signature algorithm for client authentication 2023-05-05 00:05:46 +02:00
ssl_ocsp.c BUG/MINOR: ssl: Fix potential leak in cli_parse_update_ocsp_response 2023-03-31 09:10:36 +02:00
ssl_sample.c MEDIUM: ssl: new sample fetch method to get curve name 2023-07-17 15:45:41 +02:00
ssl_sock.c BUG/MEDIUM: ssl: segfault when cipher is NULL 2023-10-30 18:08:16 +01:00
ssl_utils.c BUILD: ssl: ssl_c_r_dn fetches uses functiosn only available since 1.1.1 2023-05-15 12:07:52 +02:00
stats.c MINOR: tree-wide: Only rely on co_data() to check channel emptyness 2023-10-17 18:51:13 +02:00
stconn.c BUG/MEDIUM: stconn: Don't update stream expiration date if already expired 2023-11-09 12:08:59 +01:00
stick_table.c MINOR: stktable/cli: support v6tov4 and v4tov6 conversions 2023-11-08 16:38:06 +01:00
stream.c BUG/MEDIUM: stconn: Don't report rcv/snd expiration date if SC cannot epxire 2023-11-07 10:30:01 +01:00
task.c BUG/MINOR: task: allow to use tasklet_wakeup_after with tid -1 2023-04-18 16:20:47 +02:00
tcp_act.c MINOR: tcp_act: remove limitation on protocol for attach-srv 2023-09-29 18:11:10 +02:00
tcp_rules.c MINOR: tcp_rules: tcp-{request,response} requires TCP or HTTP mode 2023-10-06 15:34:30 +02:00
tcp_sample.c MINOR: sample: accept_date / request_date return %Ts / %tr timestamp values 2023-07-24 17:12:29 +02:00
tcpcheck.c CLEANUP: Re-apply xalloc_size.cocci (3) 2023-11-06 20:49:56 +01:00
thread.c CLEANUP: ring: rename the ring lock "RING_LOCK" instead of "LOGSRV_LOCK" 2023-09-20 21:38:33 +02:00
time.c
tools.c MINOR: cfgparse: rename "rev@" prefix to "rhttp@" 2023-10-20 14:44:37 +02:00
trace.c BUG/MINOR: trace: fix trace parser error reporting 2023-10-19 14:45:07 +02:00
uri_auth.c
uri_normalizer.c
vars.c BUILD: vars: use __fallthrough in var_accounting_{diff,add}() 2022-11-14 11:14:02 +01:00
version.c
wdt.c BUG/MEDIUM: wdt: fix wrong thread being checked for sleeping 2023-02-17 16:01:34 +01:00
xprt_handshake.c CLEANUP: pool/tree-wide: remove suffix "_pool" from certain pool names 2022-06-23 11:49:09 +02:00
xprt_quic.c REORG: quic: cleanup traces definition 2023-10-11 14:15:31 +02:00