Mercurial > hg > nginx

diff src/http/ngx_http_request.c @ 9275:199dc0d6b05b

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Added max_headers directive. The directive limits the number of request headers accepted from clients. While the total amount of headers is believed to be sufficiently limited by the existing buffer size limits (client_header_buffer_size and large_client_header_buffers), the additional limit on the number of headers might be beneficial to better protect backend servers. Requested by Maksim Yevmenkin.
author Maxim Dounin <mdounin@mdounin.ru>
date Fri, 24 May 2024 00:20:01 +0300
parents f798ecafec05
children 3c71158f5a34
line wrap: on
line diff
--- a/src/http/ngx_http_request.c	Wed May 15 10:06:00 2024 +0300
+++ b/src/http/ngx_http_request.c	Fri May 24 00:20:01 2024 +0300
@@ -1466,6 +1466,15 @@
 
             /* a header line has been parsed successfully */
 
+            if (r->headers_in.count++ >= cscf->max_headers) {
+                r->lingering_close = 1;
+                ngx_log_error(NGX_LOG_INFO, c->log, 0,
+                              "client sent too many header lines");
+                ngx_http_finalize_request(r,
+                                          NGX_HTTP_REQUEST_HEADER_TOO_LARGE);
+                break;
+            }
+
             h = ngx_list_push(&r->headers_in.headers);
             if (h == NULL) {
                 ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);