[PATCH 0 of 5] QUIC flood detection
Roman Arutyunyan
arut at nginx.com
Thu Oct 7 11:36:13 UTC 2021
This series adds support for flood detection in QUIC and HTTP/3 smilar to
HTTP/2.
- patch 1 removes client-side encoder support from HTTP/3 for simplicity
- patch 2 fixes a minor issue with $request_length calculation
- patch 3 adds HTTP/3 traffic-based flood detection
- patch 4 adds QUIC traffic-based flood detection
- patch 5 adds a limit on frames number similar to HTTP/2
As for the patch 3, both input and output traffic is analyzed similar to HTTP/2.
Probably only input should be analyzed because current HTTP/3 implementation
does not seem to allow amplification (the only exception is Stream Cancellation,
but keepalive_requests limits the damage anyway). Also, we can never be sure
the output traffic we counted actually reached the client and was not rejected
by stream reset. We can discuss this later.
More information about the nginx-devel
mailing list