search

sozu-proxy / sozu

Sōzu HTTP reverse proxy, configurable at runtime, fast and safe, built in Rust. It is awesome!
https://www.sozu.io/
GNU Affero General Public License v3.0
2.95k stars 188 forks source link

Basic DoS protection #1057

Open hugusmaximus opened 6 months ago

hugusmaximus commented 6 months ago

Hi, I can see there's a "max_connections" parameter that can be configured to limit "maximum number of connections to a worker", anyway, this will not stop a single attacker IP to trivially flood Sozu... is there any way to configure a limit of connections "per source IP"? This is a very basic feature that only stop most naive DoS attacks but it is very powerful protection mechanism. Any plan to implement this?

Keksoj commented 6 months ago

It is not yet implemented, nor is it in the roadmap, but this is a relevant issue.

A first naive implementation of a simple IP tracker would be good. It would gather information about a client accross several connections. Such an IP tracker could be used to trigger safety mechanisms, such as downgrading protocol from HTTP2 to HTTP1 (which offers exploit vulnerabilities) and tarpitting (slowing down connections for a given IP address).

The Clever Cloud team, responsible for most development on Sōzu, has yet to convene to decide about where to put such a feature in the roadmap. This issue will be updated.