Commit ab43e6ca authored by Witold Krecicki's avatar Witold Krecicki Committed by Ondřej Surý
Browse files

fix enforcement of tcp-clients (v1)

tcp-clients settings could be exceeded in some cases by
creating more and more active TCP clients that are over
the set quota limit, which in the end could lead to a
DoS attack by e.g. exhaustion of file descriptors.

If TCP client we're closing went over the quota (so it's
not attached to a quota) mark it as mortal - so that it
will be destroyed and not set up to listen for new
connections - unless it's the last client for a specific

(cherry picked from commit 9ef6eb4c)
(cherry picked from commit 264384fb)
parent 911a4589
......@@ -448,8 +448,19 @@ exit_check(ns_client_t *client) {
if (client->tcpquota != NULL)
if (client->tcpquota != NULL) {
} else {
* We went over quota with this client, we don't
* want to restart listening unless this is the
* last client on this interface, which is
* checked later.
if (TCP_CLIENT(client)) {
client->mortal = true;
if (client->timerset) {
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment