C++ broker: preventing DOS attacks by counting user connections

[Chuck Rolke <cr...@redhat.com>]

Review https://reviews.apache.org/r/4857 is a proposal to prevent one form of Denial of Service attacks. The idea is to have command line options specify the maximum number of allowed connections from individual users and from client host machines. Connections are counted as they are made and then denied if the count goes over the specified limit.

The implementation up for review is for the C++ Broker and I'd like some discussion on some high-level aspects how this feature should be implemented.

1. It's currently bundled with the ACL loadable module.  Is that an acceptable place for it or should it be part of the base broker? Or a stand-alone module?

2. The limits are specified as blanket values for all users and hosts. That is, one user cannot get a value different from another user. This seems useful for a first trial of this feature. Any objections?

3. The ACL file already has a concept of named users and user groups. If individual users were to receive different limits then the ACL file seems like a natural place for the settings. However, changing the ACL file syntax/contents has an impact on the Java Broker and should get approval first. I am not proposing to change the ACL file now.

Thanks for your input.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org