Basic DoS protection

[hugusmaximus]

Hi, I can see there's a "max_connections" parameter that can be configured to limit "maximum number of connections to a worker", anyway, this will not stop a single attacker IP to trivially flood Sozu... is there any way to configure a limit of connections "per source IP"? This is a very basic feature that only stop most naive DoS attacks but it is very powerful protection mechanism. Any plan to implement this?

[Keksoj]

It is not yet implemented, nor is it in the roadmap, but this is a relevant issue.

A first naive implementation of a simple IP tracker would be good. It would gather information about a client accross several connections. Such an IP tracker could be used to trigger safety mechanisms, such as downgrading protocol from HTTP2 to HTTP1 (which offers exploit vulnerabilities) and tarpitting (slowing down connections for a given IP address).

The Clever Cloud team, responsible for most development on Sōzu, has yet to convene to decide about where to put such a feature in the roadmap. This issue will be updated.