Fix Rustls 0.22 & 0.23 are limited to 256 handshakes per second. #3408
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
robjtede
added
A-http
robjtede
reviewed
Jun 19, 2024
|
Not sure if first two items in checklist are relevant. So will mark as ready for review and wait for a feedback. |
mstyura
force-pushed
the
fix-rustls-rate-limiting
branch
from
8880636
to
db9f7b3
Compare
robjtede
approved these changes
Jun 19, 2024
auto-merge was automatically disabled
June 19, 2024 22:23
Head branch was pushed to by a user without write access
mstyura
force-pushed
the
fix-rustls-rate-limiting
branch
from
db9f7b3
to
979aefd
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
PR Type
Bug Fix
PR Checklist
Tests for the changes have been added / updated.Documentation comments have been added / updated.Overview
Currently due to possibly accidentally missed features with
rustls 0.22and0.23above configuration statement the server does not allow configuration of TLS handshakes limit per seconds.The proposed approach is to define internal feature
__tlsand rely on it when writing feature conditions where it is expected to work on any tls implementation. Similar approach is already used by__compressfeature. Such approach will make addition of new version of rustls less error prone.The breaking change proposed is to make HttpServer::method.max_connection_rate conditionally defined based on
__tlsfeature. This will make it obvious that this method take effect only for TLS connections rate.This breaking change is completely avoidable just by moving feature condition inside method as it was before.
Closes #3407