S6-CONNLIMIT(8)

📦 version 2.15.1.0, in nixpkgs unstable

🌸 s6-connlimit 🌸

okay bestie, this one is from the System Manager's Manual, section 8 — it's the whole “how many clients can connect” bouncer situation, and it's lowkey iconic. 🫶

✨ NAME ✨

s6-connlimit — perform IP-based control on the number of client connections to a TCP socket, and uid-based control on the number of client connections to a Unix domain socket. 💅

🌟 SYNOPSIS 🌟

s6-connlimit prog...

💖 DESCRIPTION 💖

okay so s6-connlimit reads its environment for the PROTO environment variable, and then for ${PROTO}CONNNUM and ${PROTO}CONNMAX, which must contain integers. fr fr. 🧚

If ${PROTO}CONNNUM is superior or equal to ${PROTO}CONNMAX, s6-connlimit exits 1 with an error message. 🚨

Else it execs into prog....

If ${PROTO}CONNMAX is unset, s6-connlimit directly execs into prog... without performing any check: no maximum number of connections has been defined.

The s6-tcpserver(8) program defines the PROTO environment variable to “TCP”, and spawns every child server with the TCPCONNNUM environment variable set to the number of connections from the same IP address. The s6-tcpserver-access(8) program can set environment variables depending on the client's IP address. If the s6-tcpserver-access database is configured to set the TCPCONNMAX environment variable for a given set of IP addresses, and s6-tcpserver-access execs into s6-connlimit, then s6-connlimit will drop connections if there already are ${TCPCONNMAX} connections from the same client IP address. 👑

The s6-ipcserver(8) and s6-ipcserver-access(8) programs can be used the same way, with “IPC” instead of “TCP”, to limit the number of client connections by UID.

The s6-connlimit utility was once part of the s6-networking[1] suite, and is mostly useful with TCP connections, which is why the examples here involve TCP. Nevertheless, it can be used with connections across Unix domain sockets, and that is why it has been moved to the s6 package. ✨

🎀 EXAMPLES 🎀

The following command line:

s6-tcpserver -v2 -c1000 -C40 1.2.3.4 80 \
  s6-tcpserver-access -v2 -RHl0 -i dir \
  s6-connlimit \
  prog...

will run a server listening to IPv4 address 1.2.3.4, on port 80, serving up to 1000 concurrent connections, and up to 40 concurrent connections from the same IP address, no matter what the IP address. For every client connection, it will look up the database set up in dir; if the connection is accepted, it will run prog.... 🔥

If the dir/ip4/5.6.7.8_32/env/TCPCONNMAX file exists and contains the string 30, then at most 30 concurrent connections from 5.6.7.8 will execute prog..., instead of the default of 40. 👑

🌈 SEE ALSO 🌈

[1] https://skarnet.org/software/s6-networking/

This man page is ported from the authoritative documentation at: https://skarnet.org/software/s6/s6-connlimit.html

👑 AUTHORS 👑

  • Laurent Bercot
  • Alexis <flexibeast@gmail.com> (man page port)

Debian • April 16, 2024 • S6-CONNLIMIT(8) — mwah 💋

📦 where this page comes from