Skip to content

Commit

Permalink
DOC: proxy: Add "handshake" timeout documentation.
Browse files Browse the repository at this point in the history
Document the "handshake" timeout new setting available one frontend side.
This should at least be helpful for QUIC client connections to prevent
an attacker from refreshing plenty of connections without completing
the handshake step, leading haproxy to consume memory for nothing.
  • Loading branch information
haproxyFred committed Nov 17, 2023
1 parent 373e40f commit 957085e
Showing 1 changed file with 14 additions and 0 deletions.
14 changes: 14 additions & 0 deletions doc/configuration.txt
Original file line number Diff line number Diff line change
Expand Up @@ -4610,6 +4610,7 @@ timeout check X - X X
timeout client X X X -
timeout client-fin X X X -
timeout connect X - X X
timeout handshake X X X -
timeout http-keep-alive X X X X
timeout http-request X X X X
timeout queue X - X X
Expand Down Expand Up @@ -14456,6 +14457,19 @@ timeout connect <timeout>
See also: "timeout check", "timeout queue", "timeout server", "timeout tarpit".


timeout handshake <timeout>
Set the maximum time to wait for a client TLS handshake to complete. This is
usable both for TCP and QUIC connections.
May be used in sections : defaults | frontend | listen | backend
yes | yes | yes | no
Arguments :
<timeout> is the timeout value specified in milliseconds by default, but
can be in any other unit if the number is suffixed by the unit,
as explained at the top of this document.

If this handshake timeout is not set, this is the client timeout which is used
in place.

timeout http-keep-alive <timeout>
Set the maximum allowed time to wait for a new HTTP request to appear
May be used in sections : defaults | frontend | listen | backend
Expand Down

0 comments on commit 957085e

Please sign in to comment.