Skip to content

[v8.x] http2: mitigate reported DoS attacks #29124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
addaleax wants to merge 19 commits into from
Closed

[v8.x] http2: mitigate reported DoS attacks #29124

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
4d09a44
http2: improve http2 code a bit
jasnell Oct 30, 2018
b8b4ba5
deps: update nghttp2 to 1.34.0
jasnell Oct 5, 2018
6251b50
deps: update nghttp2 to 1.37.0
gengjiawen Mar 29, 2019
68a44ab
deps: update nghttp2 to 1.38.0
gengjiawen Apr 18, 2019
6a1278b
deps: update nghttp2 to 1.39.1
gengjiawen Jun 27, 2019
6deff8a
deps: update nghttp2 to 1.39.2
addaleax Aug 14, 2019
14fd420
http2: improve JS-side debug logging
addaleax Aug 5, 2019
dd6b143
http2: only call into JS when necessary for session events
addaleax Aug 9, 2019
f717523
http2: do not create ArrayBuffers when no DATA received
addaleax Aug 9, 2019
7652406
http2: limit number of rejected stream openings
addaleax Aug 10, 2019
871393f
http2: limit number of invalid incoming frames
addaleax Aug 12, 2019
a722e8c
http2: handle 0-length headers better
addaleax Aug 10, 2019
cda3bad
http2: shrink default `vector::reserve()` allocations
addaleax Aug 10, 2019
4993fa7
http2: consider 0-length non-end DATA frames an error
addaleax Aug 10, 2019
6a341af
http2: stop reading from socket if writes are in progress
addaleax Aug 10, 2019
bc112af
http2: pause input processing if sending output
addaleax Aug 11, 2019
6912e21
http2: allow security revert for Ping/Settings Flood
addaleax Aug 12, 2019
320fbea
test: apply test-http2-max-session-memory-leak from v12.x
addaleax Aug 13, 2019
5db3a94
fixup! deps: update nghttp2 to 1.39.2
addaleax Aug 14, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
http2: stop reading from socket if writes are in progress 
If a write to the underlying socket finishes asynchronously, that
means that we cannot write any more data at that point without waiting
for it to finish. If this happens, we should also not be producing any
more input.

This is part of mitigating CVE-2019-9511/CVE-2019-9517.
  • Loading branch information
@addaleax
addaleax committed Aug 14, 2019
commit 6a341af7bd89932123f55dcaef783622eec5a89d
19 changes: 18 additions & 1 deletion src/node_http2.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1585,9 +1585,18 @@ void Http2Session::OnStreamAfterWriteImpl(WriteWrap* w, int status, void* ctx) {
Http2Session* session = static_cast<Http2Session*>(ctx);
DEBUG_HTTP2SESSION2(session, "write finished with status %d", status);

CHECK_NE(session->flags_ & SESSION_STATE_WRITE_IN_PROGRESS, 0);
session->flags_ &= ~SESSION_STATE_WRITE_IN_PROGRESS;

// Inform all pending writes about their completion.
session->ClearOutgoing(status);

if ((session->flags_ & SESSION_STATE_READING_STOPPED) &&
nghttp2_session_want_read(session->session_)) {
session->flags_ &= ~SESSION_STATE_READING_STOPPED;
session->stream_->ReadStart();
}

if (!(session->flags_ & SESSION_STATE_WRITE_SCHEDULED)) {
// Schedule a new write if nghttp2 wants to send data.
session->MaybeScheduleWrite();
Expand Down Expand Up @@ -1627,10 +1636,13 @@ void Http2Session::MaybeScheduleWrite() {
}

void Http2Session::MaybeStopReading() {
if (flags_ & SESSION_STATE_READING_STOPPED) return;
int want_read = nghttp2_session_want_read(session_);
DEBUG_HTTP2SESSION2(this, "wants read? %d", want_read);
if (want_read == 0)
if (want_read == 0 || (flags_ & SESSION_STATE_WRITE_IN_PROGRESS)) {
flags_ |= SESSION_STATE_READING_STOPPED;
stream_->ReadStop();
}
}

// Unset the sending state, finish up all current writes, and reset
Expand Down Expand Up @@ -1757,6 +1769,8 @@ uint8_t Http2Session::SendPendingData() {

chunks_sent_since_last_write_++;

CHECK_EQ(flags_ & SESSION_STATE_WRITE_IN_PROGRESS, 0);

// DoTryWrite may modify both the buffer list start itself and the
// base pointers/length of the individual buffers.
uv_buf_t* writebufs = *bufs;
Expand All @@ -1766,8 +1780,11 @@ uint8_t Http2Session::SendPendingData() {
return 0;
}

flags_ |= SESSION_STATE_WRITE_IN_PROGRESS;

WriteWrap* req = AllocateSend();
if (stream_->DoWrite(req, writebufs, count, nullptr) != 0) {
flags_ &= ~SESSION_STATE_WRITE_IN_PROGRESS;
req->Dispose();
}

Expand Down
2 changes: 2 additions & 0 deletions src/node_http2.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -384,6 +384,8 @@ enum session_state_flags {
SESSION_STATE_CLOSED = 0x4,
SESSION_STATE_CLOSING = 0x8,
SESSION_STATE_SENDING = 0x10,
SESSION_STATE_WRITE_IN_PROGRESS = 0x20,
SESSION_STATE_READING_STOPPED = 0x40,
};

// This allows for 4 default-sized frames with their frame headers
Expand Down