Mercurial > hg > nginx
changeset 9236:d9a52ebb9b00
Mail: max_commands directive.
The directive specifies the maximum number of commands allowed during
authentication, after which the connection is closed. The default
limit is 1000, which is not expected to affect any well-behaving clients,
since authentication usually requires at most several commands, though
will effectively stop malicious clients from flooding the server with
with commands.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Sat, 30 Mar 2024 05:05:53 +0300 |
parents | d7fd0acdea64 |
children | 41db21d1ca7c |
files | src/mail/ngx_mail.h src/mail/ngx_mail_core_module.c src/mail/ngx_mail_handler.c |
diffstat | 3 files changed, 23 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/src/mail/ngx_mail.h Sat Mar 30 05:05:31 2024 +0300 +++ b/src/mail/ngx_mail.h Sat Mar 30 05:05:53 2024 +0300 @@ -116,6 +116,7 @@ ngx_msec_t resolver_timeout; ngx_uint_t max_errors; + ngx_uint_t max_commands; ngx_str_t server_name; @@ -234,6 +235,7 @@ ngx_array_t args; ngx_uint_t errors; + ngx_uint_t commands; ngx_uint_t login_attempt; /* used to parse POP3/IMAP/SMTP command */
--- a/src/mail/ngx_mail_core_module.c Sat Mar 30 05:05:31 2024 +0300 +++ b/src/mail/ngx_mail_core_module.c Sat Mar 30 05:05:53 2024 +0300 @@ -92,6 +92,13 @@ offsetof(ngx_mail_core_srv_conf_t, max_errors), NULL }, + { ngx_string("max_commands"), + NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1, + ngx_conf_set_num_slot, + NGX_MAIL_SRV_CONF_OFFSET, + offsetof(ngx_mail_core_srv_conf_t, max_commands), + NULL }, + ngx_null_command }; @@ -171,6 +178,7 @@ cscf->resolver_timeout = NGX_CONF_UNSET_MSEC; cscf->max_errors = NGX_CONF_UNSET_UINT; + cscf->max_commands = NGX_CONF_UNSET_UINT; cscf->resolver = NGX_CONF_UNSET_PTR; @@ -192,6 +200,7 @@ 30000); ngx_conf_merge_uint_value(conf->max_errors, prev->max_errors, 5); + ngx_conf_merge_uint_value(conf->max_commands, prev->max_commands, 1000); ngx_conf_merge_str_value(conf->server_name, prev->server_name, "");
--- a/src/mail/ngx_mail_handler.c Sat Mar 30 05:05:31 2024 +0300 +++ b/src/mail/ngx_mail_handler.c Sat Mar 30 05:05:53 2024 +0300 @@ -896,6 +896,18 @@ return NGX_ERROR; } + s->commands++; + + if (s->commands > cscf->max_commands) { + + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent too many commands"); + + s->quit = 1; + + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + return NGX_OK; }