oss/FrankerFaceZ
oss/FrankerFaceZ
1
0
Fork 0
mirror of https://github.com/FrankerFaceZ/FrankerFaceZ.git synced 2025-06-27 21:05:53 +00:00
Code Wiki Activity

Reject over capacity before finishing TLS handshake

Browse source
This commit is contained in:
Kane York 2017-11-13 12:48:56 -08:00
parent 26cddf5271
commit a0b3e049d0
2 changed files with 28 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

3
socketserver/cmd/ffzsocketserver/socketserver.go
View file

@ -81,7 +81,8 @@ func main() {
Addr: conf.SSLListenAddr,
Handler: http.DefaultServeMux,
TLSConfig: &tls.Config{
GetCertificate: reloader.GetCertificateFunc(),
GetCertificate: reloader.GetCertificateFunc(),
GetConfigForClient: server.TLSEarlyReject,
},
}
go func() {

37
socketserver/server/handlecore.go
View file

@ -2,6 +2,7 @@ package server // import "github.com/FrankerFaceZ/FrankerFaceZ/socketserver/serv
import (
"bytes"
"crypto/tls"
"encoding/json"
"errors"
"fmt"
@ -239,6 +240,29 @@ var BannerHTML []byte
// StopAcceptingConnectionsCh is closed while the server is shutting down.
var StopAcceptingConnectionsCh = make(chan struct{})
func shouldRejectConnection() bool {
memFreeKB := atomic.LoadUint64(&Statistics.SysMemFreeKB)
if memFreeKB > 0 && memFreeKB < Configuration.MinMemoryKBytes {
return true
}
curClients := atomic.LoadUint64(&Statistics.CurrentClientCount)
if Configuration.MaxClientCount != 0 && curClients >= Configuration.MaxClientCount {
return true
}
return false
}
var errEarlyTLSReject = errors.New("over capacity")
func TLSEarlyReject(*tls.ClientHelloInfo) (*tls.Config, error) {
if shouldRejectConnection() {
return nil, errEarlyTLSReject
}
return nil, nil
}
// HTTPHandleRootURL is the http.HandleFunc for requests on `/`.
// It either uses the SocketUpgrader or writes out the BannerHTML.
func HTTPHandleRootURL(w http.ResponseWriter, r *http.Request) {
@ -251,21 +275,12 @@ func HTTPHandleRootURL(w http.ResponseWriter, r *http.Request) {
if strings.Contains(strings.ToLower(r.Header.Get("Connection")), "upgrade") {
updateSysMem()
if Statistics.SysMemFreeKB > 0 && Statistics.SysMemFreeKB < Configuration.MinMemoryKBytes {
if shouldRejectConnection() {
w.WriteHeader(503)
fmt.Fprint(w, "error: low memory")
fmt.Fprint(w, "connection rejected: over capacity")
return
}
if Configuration.MaxClientCount != 0 {
curClients := atomic.LoadUint64(&Statistics.CurrentClientCount)
if curClients >= Configuration.MaxClientCount {
w.WriteHeader(503)
fmt.Fprint(w, "error: client limit reached")
return
}
}
conn, err := SocketUpgrader.Upgrade(w, r, nil)
if err != nil {
fmt.Fprintf(w, "error: %v", err)