astelm/telemt
1
0
Fork 0
mirror of https://github.com/telemt/telemt.git synced 2026-09-05 18:16:06 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #877 from anton-vinogradov/fix/synlimit-default-burst

Browse Source 
fix(synlimit): raise default synlimit_burst from 1 to 24
This commit is contained in:
Alexey
2026-08-12 21:26:16 +03:00
committed by GitHub
parent 08127f318d f770756cba
commit c488970569
5 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Config_params/CONFIG_PARAMS.de.md
+3 -3
View File
@@ -2314,7 +2314,7 @@ Hinweis: Dieser Abschnitt akzeptiert auch den Legacy-Alias `[server.admin_api]`
| [`synlimit`](#synlimit-serverlisteners) | `false`, `"iptables"` oder `"nftables"` | `false` | `✔` |
| [`synlimit_seconds`](#synlimit_seconds-serverlisteners) | `u32` | `60` | `✔` |
| [`synlimit_hitcount`](#synlimit_hitcount-serverlisteners) | `u32` | `48` | `✔` |
| [`synlimit_burst`](#synlimit_burst-serverlisteners) | `u32` | `1` | `✔` |
| [`synlimit_burst`](#synlimit_burst-serverlisteners) | `u32` | `24` | `✔` |
| [`synlimit_ios_seconds`](#synlimit_ios_seconds-serverlisteners) | `u32` | `1` | `✔` |
| [`synlimit_ios_hitcount`](#synlimit_ios_hitcount-serverlisteners) | `u32` | `12` | `✔` |
| [`synlimit_ios_burst`](#synlimit_ios_burst-serverlisteners) | `u32` | `24` | `✔` |
@@ -2397,7 +2397,7 @@ Hinweis: Dieser Abschnitt akzeptiert auch den Legacy-Alias `[server.admin_api]`
synlimit_hitcount = 48
```
## synlimit_burst (server.listeners)
- **Einschränkungen / Validierung**: `u32`, muss `> 0` sein. Der Default ist `1`.
- **Einschränkungen / Validierung**: `u32`, muss `> 0` sein. Der Default ist `24`.
- **Beschreibung**: Generische SYN-Fix-Token-Bucket-Burst-Größe. Höhere Werte ermöglichen kurze Verbindungsstöße von derselben Source-IP, bevor die stabile `synlimit_hitcount / synlimit_seconds`-Rate durchgesetzt wird.
- **Beispiel**:
@@ -2406,7 +2406,7 @@ Hinweis: Dieser Abschnitt akzeptiert auch den Legacy-Alias `[server.admin_api]`
ip = "0.0.0.0"
port = 443
synlimit = "iptables"
synlimit_burst = 1
synlimit_burst = 24
```
## synlimit_ios_seconds (server.listeners)
- **Einschränkungen / Validierung**: `u32`, muss `> 0` sein. Der Default ist `1`.
docs/Config_params/CONFIG_PARAMS.en.md
+3 -3
View File
@@ -2314,7 +2314,7 @@ Note: This section also accepts the legacy alias `[server.admin_api]` (same sche
| [`synlimit`](#synlimit-serverlisteners) | `false`, `"iptables"`, `"nftables"`, or `"pf"` | `false` | `✔` |
| [`synlimit_seconds`](#synlimit_seconds-serverlisteners) | `u32` | `60` | `✔` |
| [`synlimit_hitcount`](#synlimit_hitcount-serverlisteners) | `u32` | `48` | `✔` |
| [`synlimit_burst`](#synlimit_burst-serverlisteners) | `u32` | `1` | `✔` |
| [`synlimit_burst`](#synlimit_burst-serverlisteners) | `u32` | `24` | `✔` |
| [`synlimit_ios_seconds`](#synlimit_ios_seconds-serverlisteners) | `u32` | `1` | `✔` |
| [`synlimit_ios_hitcount`](#synlimit_ios_hitcount-serverlisteners) | `u32` | `12` | `✔` |
| [`synlimit_ios_burst`](#synlimit_ios_burst-serverlisteners) | `u32` | `24` | `✔` |
@@ -2402,7 +2402,7 @@ Note: This section also accepts the legacy alias `[server.admin_api]` (same sche
synlimit_hitcount = 48
```
## synlimit_burst (server.listeners)
- **Constraints / validation**: `u32`, must be `> 0`. Default is `1`.
- **Constraints / validation**: `u32`, must be `> 0`. Default is `24`.
- **Description**: Generic SYN-fix token-bucket burst size. Higher values allow short connection bursts from the same source IP before the steady-state `synlimit_hitcount / synlimit_seconds` rate is enforced.
- **Example**:
@@ -2411,7 +2411,7 @@ Note: This section also accepts the legacy alias `[server.admin_api]` (same sche
ip = "0.0.0.0"
port = 443
synlimit = "iptables"
synlimit_burst = 1
synlimit_burst = 24
```
## synlimit_ios_seconds (server.listeners)
- **Constraints / validation**: `u32`, must be `> 0`. Default is `1`.
docs/Config_params/CONFIG_PARAMS.ru.md
+3 -3
View File
@@ -2240,7 +2240,7 @@
| [`synlimit`](#synlimit-serverlisteners) | `false`, `"iptables"` или `"nftables"` | `false` | `✔` |
| [`synlimit_seconds`](#synlimit_seconds-serverlisteners) | `u32` | `60` | `✔` |
| [`synlimit_hitcount`](#synlimit_hitcount-serverlisteners) | `u32` | `48` | `✔` |
| [`synlimit_burst`](#synlimit_burst-serverlisteners) | `u32` | `1` | `✔` |
| [`synlimit_burst`](#synlimit_burst-serverlisteners) | `u32` | `24` | `✔` |
| [`synlimit_ios_seconds`](#synlimit_ios_seconds-serverlisteners) | `u32` | `1` | `✔` |
| [`synlimit_ios_hitcount`](#synlimit_ios_hitcount-serverlisteners) | `u32` | `12` | `✔` |
| [`synlimit_ios_burst`](#synlimit_ios_burst-serverlisteners) | `u32` | `24` | `✔` |
@@ -2323,7 +2323,7 @@
synlimit_hitcount = 48
```
## synlimit_burst (server.listeners)
- **Ограничения / валидация**: `u32`, должно быть `> 0`. Значение по умолчанию: `1`.
- **Ограничения / валидация**: `u32`, должно быть `> 0`. Значение по умолчанию: `24`.
- **Описание**: Generic SYN-fix token-bucket burst size. Более высокие значения разрешают short connection bursts с одного source IP перед применением steady-state rate `synlimit_hitcount / synlimit_seconds`.
- **Пример**:
@@ -2332,7 +2332,7 @@
ip = "0.0.0.0"
port = 443
synlimit = "iptables"
synlimit_burst = 1
synlimit_burst = 24
```
## synlimit_ios_seconds (server.listeners)
- **Ограничения / валидация**: `u32`, должно быть `> 0`. Значение по умолчанию: `1`.
src/config/defaults.rs
+1 -1
View File
@@ -62,7 +62,7 @@ const DEFAULT_CONNTRACK_PRESSURE_LOW_WATERMARK_PCT: u8 = 70;
const DEFAULT_CONNTRACK_DELETE_BUDGET_PER_SEC: u64 = 4096;
const DEFAULT_SYNLIMIT_SECONDS: u32 = 60;
const DEFAULT_SYNLIMIT_HITCOUNT: u32 = 48;
const DEFAULT_SYNLIMIT_BURST: u32 = 1;
const DEFAULT_SYNLIMIT_BURST: u32 = 24;
const DEFAULT_SYNLIMIT_IOS_SECONDS: u32 = 1;
const DEFAULT_SYNLIMIT_IOS_HITCOUNT: u32 = 12;
const DEFAULT_SYNLIMIT_IOS_BURST: u32 = 24;
src/config/tests/load_basic_tests.rs
+1 -1
View File
@@ -54,7 +54,7 @@ fn synlimit_synfix_defaults_are_loaded_for_listener() {
let listener = &cfg.server.listeners[0];
assert_eq!(listener.synlimit_seconds, 60);
assert_eq!(listener.synlimit_hitcount, 48);
assert_eq!(listener.synlimit_burst, 1);
assert_eq!(listener.synlimit_burst, 24);
assert_eq!(listener.synlimit_ios_seconds, 1);
assert_eq!(listener.synlimit_ios_hitcount, 12);
assert_eq!(listener.synlimit_ios_burst, 24);