fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

socketengine: per-IP accept-rate limiter (token bucket, accept_rate/accept_burst, off by default) — drops connection-churn floods at the accept edge before any state is allocated; exempts trusted proxies and server links

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-12 17:05:24 +00:00
parent 2aaa5ac091
commit 41826c8e1a
4 changed files with 136 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

6
echoircd.conf.example
View file

@ -145,6 +145,12 @@ amu_target = both
# round-robins connections across the pool; the core stays single-threaded and lock-free.
# io_threads = 0 # reactor workers; 0 = auto (one per core, capped at 4)
# tls_handshake_timeout = 15 # drop a TLS conn that stalls mid-handshake (secs; 0 = off)
# Per-IP accept-rate limit: drop connection-churn floods at the accept edge, before any
# per-connection state is allocated (complements the connclass concurrent clone caps).
# Off by default; a generous value never affects real clients but stops a flooder
# opening/closing connections in a loop. Trusted proxies and server links are exempt.
# accept_rate = 0 # max NEW connections/sec per source IP (0 = off)
# accept_burst = 0 # instantaneous burst allowed per IP (0 = same as accept_rate)
# --- ident (RFC1413): off by default; a connection class can also enable it ---
# useident = yes # look up every client's ident (adds connect latency)