Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Cache] Unathorized clients should be blocked before accessing cache #899

Closed
vankoven opened this issue Feb 1, 2018 · 0 comments
Closed

Comments

@vankoven
Copy link
Contributor

vankoven commented Feb 1, 2018

When a new request is received it's forwarded to cache first:

if (tfw_cache_process(req, NULL, tfw_http_req_cache_cb)) {

and only after that sticky cookie is checked:

tempesta/tempesta_fw/http.c

Lines 1966 to 1970 in 195d85e

r = tfw_http_sess_obtain(req);
if (r < 0)
goto send_500;
if (r > 0) /* Response sent, nothing to do. */
return;

That leads to unnecessary cache lookup for requests with violated or expired sticky cookie. Early blocking of unauthorized clients will help us to save resources under DDOS attacks.

@krizhanovsky krizhanovsky added this to the 0.8 TDB v0.2 milestone Feb 2, 2018
@krizhanovsky krizhanovsky modified the milestones: 0.8 TDB v0.2, 0.6 KTLS Mar 22, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants