tree 48eb33abec34f6f5f3e35426c6a30c2ff3b94785
parent 71b734c30725c15f5108f2b2aa9620eea1152a32
author Willy Tarreau <w@1wt.eu> 1381164667 +0200
committer Willy Tarreau <w@1wt.eu> 1390920567 +0100
encoding latin1

MEDIUM: listener: add support for limiting the session rate in addition to the connection rate

It's sometimes useful to be able to limit the connection rate on a machine
running many haproxy instances (eg: per customer) but it removes the ability
for that machine to defend itself against a DoS. Thus, better also provide a
limit on the session rate, which does not include the connections rejected by
"tcp-request connection" rules. This permits to have much higher limits on
the connection rate without having to raise the session rate limit to insane
values.

The limit can be changed on the CLI using "set rate-limit sessions global",
or in the global section using "maxsessrate".