mirror of https://github.com/coredns/coredns.git synced 2026-10-08 19:45:21 -04:00

Files

myohannes 2b8c305203 plugin/https: Add max_streams to limit HTTP/2 concurrent streams (#8522 )

Add a max_streams option to the *https* plugin to limit the number of
concurrent HTTP/2 streams per DoH connection. This lets operators cap
per-connection concurrency (guarding against resource exhaustion) or
raise it above the Go default for high-fan-in clients that multiplex
many requests over a single connection.

Semantics match the existing *https3* plugin's max_streams:
- omitted  -> Go HTTP/2 server default is used
- 0        -> use the underlying HTTP/2 transport default
- positive -> advertise exactly that many concurrent streams
- negative -> rejected at config parse time

The limit is applied via the standard library http.Server.HTTP2
(HTTP2Config.MaxConcurrentStreams) so it is advertised in the server's
SETTINGS frame.

Signed-off-by: Mekias Yohannes <mmyohannes@gmail.com>

2026-09-06 19:16:44 -07:00

1.3 KiB

Raw Blame History

https

Name

https - configures DNS-over-HTTPS (DoH) server options.

Description

The https plugin allows you to configure parameters for the DNS-over-HTTPS (DoH) server to fine-tune the security posture and performance of the server.

This plugin can only be used once per HTTPS listener block.

Syntax

https {
    max_connections NON_NEGATIVE_INTEGER
    max_streams NON_NEGATIVE_INTEGER
}

max_connections limits the number of concurrent TCP connections to the HTTPS server. The default value is 200 if not specified. Set to 0 for unbounded.
max_streams limits the number of concurrent HTTP/2 streams per HTTPS connection. This helps prevent unbounded streams on a single connection, exhausting server resources. The default value is 250 if not specified. Set to 0 to use the underlying HTTP/2 transport default.

Examples

Set custom limits for maximum connections and streams:

https://.:443 {
    tls cert.pem key.pem
    https {
        max_connections 100
        max_streams 100
    }
    whoami
}

Set both values to 0 to disable the CoreDNS limits (unbounded connections and the underlying HTTP/2 transport stream default), matching CoreDNS behaviour before v1.14.0:

https://.:443 {
    tls cert.pem key.pem
    https {
        max_connections 0
        max_streams 0
    }
    whoami
}

1.3 KiB Raw Blame History