From 957085e85deee6998abf86baa54d6ff19e101f09 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20L=C3=A9caille?= Date: Wed, 15 Nov 2023 16:06:21 +0100 Subject: [PATCH] DOC: proxy: Add "handshake" timeout documentation. Document the "handshake" timeout new setting available one frontend side. This should at least be helpful for QUIC client connections to prevent an attacker from refreshing plenty of connections without completing the handshake step, leading haproxy to consume memory for nothing. --- doc/configuration.txt | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/doc/configuration.txt b/doc/configuration.txt index 0d23c353b..8c81bd95a 100644 --- a/doc/configuration.txt +++ b/doc/configuration.txt @@ -4610,6 +4610,7 @@ timeout check X - X X timeout client X X X - timeout client-fin X X X - timeout connect X - X X +timeout handshake X X X - timeout http-keep-alive X X X X timeout http-request X X X X timeout queue X - X X @@ -14456,6 +14457,19 @@ timeout connect See also: "timeout check", "timeout queue", "timeout server", "timeout tarpit". +timeout handshake + Set the maximum time to wait for a client TLS handshake to complete. This is + usable both for TCP and QUIC connections. + May be used in sections : defaults | frontend | listen | backend + yes | yes | yes | no + Arguments : + is the timeout value specified in milliseconds by default, but + can be in any other unit if the number is suffixed by the unit, + as explained at the top of this document. + + If this handshake timeout is not set, this is the client timeout which is used + in place. + timeout http-keep-alive Set the maximum allowed time to wait for a new HTTP request to appear May be used in sections : defaults | frontend | listen | backend