s6-connlimit.html (3740B)
1 <html> 2 <head> 3 <meta name="viewport" content="width=device-width, initial-scale=1.0" /> 4 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> 5 <meta http-equiv="Content-Language" content="en" /> 6 <title>s6: the s6-connlimit program</title> 7 <meta name="Description" content="s6: the s6-connlimit program" /> 8 <meta name="Keywords" content="s6 connection limit s6-connlimit" /> 9 <!-- <link rel="stylesheet" type="text/css" href="//skarnet.org/default.css" /> --> 10 </head> 11 <body> 12 13 <p> 14 <a href="index.html">s6</a><br /> 15 <a href="//skarnet.org/software/">Software</a><br /> 16 <a href="//skarnet.org/">skarnet.org</a> 17 </p> 18 19 <h1> The <tt>s6-connlimit</tt> program </h1> 20 21 <p> 22 <tt>s6-connlimit</tt> is a small utility to perform IP-based 23 control on the number of client connections to a TCP socket, and 24 uid-based control on the number of client connections to a Unix 25 domain socket. 26 </p> 27 28 <h2> Interface </h2> 29 30 <pre> 31 s6-connlimit <em>prog...</em> 32 </pre> 33 34 <ul> 35 <li> <tt>s6-connlimit</tt> reads its environment for the PROTO 36 environment variable, and then for ${PROTO}CONNNUM and ${PROTO}CONNMAX, 37 which must contain integers. </li> 38 <li> If the value of ${PROTO}CONNNUM is superior or equal to the value 39 of ${PROTO}CONNMAX, s6-connlimit exits 1 with an error message. </li> 40 <li> Else it execs into <em>prog...</em>. </li> 41 <li> If ${PROTO}CONNMAX is unset, s6-connlimit directly execs into 42 <em>prog...</em> without performing any check: 43 no maximum number of connections has been defined. </li> 44 </ul> 45 46 <h2> Usage </h2> 47 48 <p> 49 The <a href="//skarnet.org/software/s6-networking/s6-tcpserver.html">s6-tcpserver</a> program 50 defines the PROTO environment variable to "TCP", and spawns every child server with the TCPCONNNUM environment 51 variable set to the number of connections from the same IP address. 52 The <a href="//skarnet.org/software/s6-networking/s6-tcpserver-access.html">s6-tcpserver-access</a> program 53 can set environment variables depending on the client's IP address. If the 54 s6-tcpserver-access database is configured to set the TCPCONNMAX environment 55 variable for a given set of IP addresses, and s6-tcpserver-access execs into 56 s6-connlimit, then s6-connlimit will drop connections if there already are 57 ${TCPCONNMAX} connections from the same client IP address. 58 </p> 59 60 <p> 61 The <a href="s6-ipcserver.html">s6-ipcserver</a> and 62 <a href="s6-ipcserver-access.html">s6-ipcserver-access</a> programs can 63 be used the same way, with "IPC" instead of "TCP", to limit the number 64 of client connections by UID. 65 </p> 66 67 <h2> Example </h2> 68 69 <p> 70 The following command line: 71 </p> 72 73 <pre> 74 s6-tcpserver -v2 -c1000 -C40 1.2.3.4 80 \ 75 s6-tcpserver-access -v2 -RHl0 -i <em>dir</em> \ 76 s6-connlimit \ 77 <em>prog...</em> 78 </pre> 79 80 <p> 81 will run a server listening to IPv4 address 1.2.3.4, on port 80, 82 serving up to 1000 concurrent connections, and up to 40 concurrent 83 connections from the same IP address, no matter what the IP address. 84 For every client connection, it will look up the database set up 85 in <em>dir</em>; if the connection is accepted, it will run <em>prog...</em>. 86 </p> 87 88 <p> 89 If the <tt><em>dir</em>/ip4/5.6.7.8_32/env/TCPCONNMAX</tt> file 90 exists and contains the string <tt>30</tt>, then at most 30 concurrent 91 connections from 5.6.7.8 will execute <em>prog...</em>, instead of the 92 default of 40. 93 </p> 94 95 <h2> Notes </h2> 96 97 <ul> 98 <li> The s6-connlimit utility was once part of the 99 <a href="//skarnet.org/software/s6-networking/">s6-networking</a> 100 suite, and is mostly useful with TCP connections, which is why the 101 examples here involve TCP. Nevertheless, it can be used with connections 102 across Unix domain sockets, and that is why it has been moved to the s6 103 package. </li> 104 </ul> 105 106 </body> 107 </html>