Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

http2: mitigate reported DoS attacks #29122

Closed
wants to merge 13 commits into from
Closed

Commits on Aug 14, 2019

  1. deps: update nghttp2 to 1.39.2

    This includes mitigations for CVE-2019-9512/CVE-2019-9515.
    addaleax committed Aug 14, 2019
    Configuration menu
    Copy the full SHA
    46c1da1 View commit details
    Browse the repository at this point in the history
  2. http2: improve JS-side debug logging

    DRY up the `debug()` calls, and in particular, avoid building template
    strings before we know whether we need to.
    addaleax committed Aug 14, 2019
    Configuration menu
    Copy the full SHA
    cc4b589 View commit details
    Browse the repository at this point in the history
  3. http2: only call into JS when necessary for session events

    For some JS events, it only makes sense to call into JS when there
    are listeners for the event in question.
    
    The overhead is noticeable if a lot of these events are emitted during
    the lifetime of a session. To reduce this overhead, keep track of
    whether any/how many JS listeners are present, and if there are none,
    skip calls into JS altogether.
    
    This is part of performance improvements to mitigate CVE-2019-9513.
    addaleax committed Aug 14, 2019
    Configuration menu
    Copy the full SHA
    85512ec View commit details
    Browse the repository at this point in the history
  4. http2: do not create ArrayBuffers when no DATA received

    Lazily allocate `ArrayBuffer`s for the contents of DATA frames.
    Creating `ArrayBuffer`s is, sadly, not a cheap operation with V8.
    
    This is part of performance improvements to mitigate CVE-2019-9513.
    
    Together with the previous commit, these changes improve throughput
    in the adversarial case by about 100 %, and there is little more
    that we can do besides artificially limiting the rate of incoming
    metadata frames (i.e. after this patch, CPU usage is virtually
    exclusively in libnghttp2).
    addaleax committed Aug 14, 2019
    Configuration menu
    Copy the full SHA
    d642202 View commit details
    Browse the repository at this point in the history
  5. http2: limit number of rejected stream openings

    Limit the number of streams that are rejected upon creation. Since
    each such rejection is associated with an `NGHTTP2_ENHANCE_YOUR_CALM`
    error that should tell the peer to not open any more streams,
    continuing to open streams should be read as a sign of a misbehaving
    peer. The limit is currently set to 100 but could be changed or made
    configurable.
    
    This is intended to mitigate CVE-2019-9514.
    addaleax committed Aug 14, 2019
    Configuration menu
    Copy the full SHA
    f33d342 View commit details
    Browse the repository at this point in the history
  6. http2: limit number of invalid incoming frames

    Limit the number of invalid input frames, as they may be pointing towards a
    misbehaving peer. The limit is currently set to 1000 but could be changed or
    made configurable.
    
    This is intended to mitigate CVE-2019-9514.
    addaleax committed Aug 14, 2019
    Configuration menu
    Copy the full SHA
    c1ff7e7 View commit details
    Browse the repository at this point in the history
  7. http2: handle 0-length headers better

    Ignore headers with 0-length names and track memory for headers
    the way we track it for other HTTP/2 session memory too.
    
    This is intended to mitigate CVE-2019-9516.
    addaleax committed Aug 14, 2019
    Configuration menu
    Copy the full SHA
    dc51a63 View commit details
    Browse the repository at this point in the history
  8. http2: shrink default vector::reserve() allocations

    Allocating memory upfront comes with overhead, and in particular,
    `std::vector` implementations do not necessarily return memory
    to the system when one might expect that (e.g. after shrinking the
    vector).
    addaleax committed Aug 14, 2019
    Configuration menu
    Copy the full SHA
    bfcae45 View commit details
    Browse the repository at this point in the history
  9. http2: consider 0-length non-end DATA frames an error

    This is intended to mitigate CVE-2019-9518.
    addaleax committed Aug 14, 2019
    Configuration menu
    Copy the full SHA
    cc17632 View commit details
    Browse the repository at this point in the history
  10. http2: stop reading from socket if writes are in progress

    If a write to the underlying socket finishes asynchronously, that
    means that we cannot write any more data at that point without waiting
    for it to finish. If this happens, we should also not be producing any
    more input.
    
    This is part of mitigating CVE-2019-9511/CVE-2019-9517.
    addaleax committed Aug 14, 2019
    Configuration menu
    Copy the full SHA
    c13022c View commit details
    Browse the repository at this point in the history
  11. http2: pause input processing if sending output

    If we are waiting for the ability to send more output, we should not
    process more input. This commit a) makes us send output earlier,
    during processing of input, if we accumulate a lot and b) allows
    interrupting the call into nghttp2 that processes input data
    and resuming it at a later time, if we do find ourselves in a position
    where we are waiting to be able to send more output.
    
    This is part of mitigating CVE-2019-9511/CVE-2019-9517.
    addaleax committed Aug 14, 2019
    Configuration menu
    Copy the full SHA
    164ac5b View commit details
    Browse the repository at this point in the history
  12. http2: allow security revert for Ping/Settings Flood

    nghttp2 has updated its limit for outstanding Ping/Settings ACKs
    to 1000. This commit allows reverting to the old default of 10000.
    
    The associated CVEs are CVE-2019-9512/CVE-2019-9515.
    addaleax committed Aug 14, 2019
    Configuration menu
    Copy the full SHA
    81f52dc View commit details
    Browse the repository at this point in the history
  13. Configuration menu
    Copy the full SHA
    8b1cd59 View commit details
    Browse the repository at this point in the history