path: root/doc/src/manual/cowboy_http2.asciidoc
diff options
authorLoïc Hoguin <[email protected]>2019-10-02 10:44:45 +0200
committerLoïc Hoguin <[email protected]>2019-10-02 10:44:45 +0200
commitab44985a9eeb1f664f38d6049a2532d83de7fa18 (patch)
tree3d9f1045151ae38a3cf13f019134ff892c21f1b8 /doc/src/manual/cowboy_http2.asciidoc
parente1d452411873cc11530f5e01d30b5f27e38a9423 (diff)
A number of HTTP/2 CVEs were documented recently: https://www.kb.cert.org/vuls/id/605641/ This commit, along with a few changes and additions in Cowlib, fix or improve protection against all of them. For CVE-2019-9511, also known as Data Dribble, the new option stream_window_data_threshold can be used to control how little the DATA frames that Cowboy sends can get. For CVE-2019-9516, also known as 0-Length Headers Leak, Cowboy will now simply reject streams containing 0-length header names. For CVE-2019-9517, also known as Internal Data Buffering, the backpressure changes were already pretty good at preventing this issue, but a new option max_connection_buffer_size was added for even better control over how much memory we are willing to allocate. For CVE-2019-9512, also known as Ping Flood; CVE-2019-9515, also known as Settings Flood; CVE-2019-9518, also known as Empty Frame Flooding; and similar undocumented scenarios, a frame rate limiting mechanism was added. By default Cowboy will now allow 1000 frames every 10 seconds. This can be configured via max_received_frame_rate. For CVE-2019-9514, also known as Reset Flood, another rate limiting mechanism was added and can be configured via max_reset_stream_rate. By default Cowboy will do up to 10 stream resets every 10 seconds. Finally, nothing was done for CVE-2019-9513, also known as Resource Loop, because Cowboy does not currently implement the HTTP/2 priority mechanism (in parts because these issues were well known from the start). Tests were added for all cases except Internal Data Buffering, which I'm not sure how to test, and Resource Loop, which is not currently relevant.
Diffstat (limited to 'doc/src/manual/cowboy_http2.asciidoc')
1 files changed, 40 insertions, 2 deletions
diff --git a/doc/src/manual/cowboy_http2.asciidoc b/doc/src/manual/cowboy_http2.asciidoc
index e899289..2764705 100644
--- a/doc/src/manual/cowboy_http2.asciidoc
+++ b/doc/src/manual/cowboy_http2.asciidoc
@@ -26,11 +26,14 @@ opts() :: #{
initial_connection_window_size => 65535..16#7fffffff,
initial_stream_window_size => 0..16#7fffffff,
max_concurrent_streams => non_neg_integer() | infinity,
+ max_connection_buffer_size => non_neg_integer(),
max_connection_window_size => 0..16#7fffffff,
max_decode_table_size => non_neg_integer(),
max_encode_table_size => non_neg_integer(),
max_frame_size_received => 16384..16777215,
max_frame_size_sent => 16384..16777215 | infinity,
+ max_received_frame_rate => {pos_integer(), timeout()},
+ max_reset_stream_rate => {pos_integer(), timeout()},
max_stream_buffer_size => non_neg_integer(),
max_stream_window_size => 0..16#7fffffff,
preface_timeout => timeout(),
@@ -38,6 +41,7 @@ opts() :: #{
sendfile => boolean(),
settings_timeout => timeout(),
stream_handlers => [module()],
+ stream_window_data_threshold => 0..16#7fffffff,
stream_window_margin_size => 0..16#7fffffff,
stream_window_update_threshold => 0..16#7fffffff
@@ -104,6 +108,12 @@ max_concurrent_streams (infinity)::
Maximum number of concurrent streams allowed on the connection.
+max_connection_buffer_size (16000000)::
+Maximum size of all stream buffers for this connection, in bytes.
+This is a soft limit used to apply backpressure to handlers that
+send data faster than the HTTP/2 connection allows.
max_connection_window_size (16#7fffffff)::
Maximum connection window size in bytes. This is used as an upper bound
@@ -137,6 +147,22 @@ following the client's advertised maximum.
Note that actual frame sizes may be lower than the limit when
there is not enough space left in the flow control window.
+max_received_frame_rate ({1000, 10000})::
+Maximum frame rate allowed per connection. The rate is expressed
+as a tuple `{NumFrames, TimeMs}` indicating how many frames are
+allowed over the given time period. This is similar to a supervisor
+restart intensity/period.
+max_reset_stream_rate ({10, 10000})::
+Maximum reset stream rate per connection. This can be used to
+protect against misbehaving or malicious peers that do not follow
+the protocol, leading to the server resetting streams, by limiting
+the number of streams that can be reset over a certain time period.
+The rate is expressed as a tuple `{NumResets, TimeMs}`. This is
+similar to a supervisor restart intensity/period.
max_stream_buffer_size (8000000)::
Maximum stream buffer size in bytes. This is a soft limit used
@@ -173,6 +199,13 @@ stream_handlers ([cowboy_stream_h])::
Ordered list of stream handlers that will handle all stream events.
+stream_window_data_threshold (16384)::
+Window threshold in bytes below which Cowboy will not attempt
+to send data, with one exception. When Cowboy has data to send
+and the window is high enough, Cowboy will always send the data,
+regardless of this option.
stream_window_margin_size (65535)::
Extra amount in bytes to be added to the window size when
@@ -193,9 +226,14 @@ too many `WINDOW_UPDATE` frames.
`max_connection_window_size`, `max_stream_window_size`,
`stream_window_margin_size` and
`stream_window_update_threshold` to configure
- behavior on sending WINDOW_UPDATE frames, and
+ behavior on sending WINDOW_UPDATE frames;
+ `max_connection_buffer_size` and
`max_stream_buffer_size` to apply backpressure
- when sending data too fast.
+ when sending data too fast;
+ `max_received_frame_rate` and `max_reset_stream_rate`
+ to protect against various flood scenarios; and
+ `stream_window_data_threshold` to control how small
+ the DATA frames that Cowboy sends can get.
* *2.6*: The `proxy_header` and `sendfile` options were added.
* *2.4*: Add the options `initial_connection_window_size`,
`initial_stream_window_size`, `max_concurrent_streams`,