Age | Commit message (Collapse) | Author |
|
A number of HTTP/2 CVEs were documented recently:
https://www.kb.cert.org/vuls/id/605641/
This commit, along with a few changes and additions in Cowlib,
fix or improve protection against all of them.
For CVE-2019-9511, also known as Data Dribble, the new option
stream_window_data_threshold can be used to control how little
the DATA frames that Cowboy sends can get.
For CVE-2019-9516, also known as 0-Length Headers Leak, Cowboy
will now simply reject streams containing 0-length header names.
For CVE-2019-9517, also known as Internal Data Buffering, the
backpressure changes were already pretty good at preventing this
issue, but a new option max_connection_buffer_size was added for
even better control over how much memory we are willing to allocate.
For CVE-2019-9512, also known as Ping Flood; CVE-2019-9515, also
known as Settings Flood; CVE-2019-9518, also known as Empty Frame
Flooding; and similar undocumented scenarios, a frame rate limiting
mechanism was added. By default Cowboy will now allow 1000 frames
every 10 seconds. This can be configured via max_received_frame_rate.
For CVE-2019-9514, also known as Reset Flood, another rate limiting
mechanism was added and can be configured via max_reset_stream_rate.
By default Cowboy will do up to 10 stream resets every 10 seconds.
Finally, nothing was done for CVE-2019-9513, also known as Resource
Loop, because Cowboy does not currently implement the HTTP/2
priority mechanism (in parts because these issues were well known
from the start).
Tests were added for all cases except Internal Data Buffering,
which I'm not sure how to test, and Resource Loop, which is not
currently relevant.
|
|
|
|
|
|
|
|
|
|
On Windows the loopback MTU seems to be set to 0xFFFFFFFF
(basically no limit) which makes the test irrelevant.
|
|
This should increase the likelihood of the test succeeding
on slower systems when run over TLS.
|
|
|
|
|
|
This should limit the amount of memory that Cowboy is using
when a handler is sending data much faster than the network.
The new max_stream_buffer_size is a soft limit and only has
an effect when the cowboy_stream_h handler is used.
|
|
As a result we explictly reject path_info components that include
a forward slash, backward slash or NUL character. This only applies
to the [...] part of the path for dir/priv_dir configuration.
Also improve the tests so that they work on Windows.
|
|
|
|
|
|
On macOS this resulted in failure because the mtime did not
change between test groups. The mtime should now always change.
|
|
|
|
For long-running connections it was possible for the connection
window to become larger than allowed by the protocol because the
window increases claimed by stream handlers were never reclaimed
even if no data was consumed.
The new code applies heuristics to fix this and reduce the number
of WINDOW_UPDATE frames that are sent. It includes six new options
to control that behavior: margin, max and threshold for both the
connection and stream windows. The margin is some extra space
added on top of the requested read size. The max is the maximum
window size at any given time. The threshold is a minimum window
size that must be reached before we even consider sending more
WINDOW_UPDATE frames. We also avoid sending WINDOW_UPDATE frames
when there is already enough space in the window, or when the
read size is 0.
Cowlib is set to master until a new tag is done.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
A bug was fixed in cowboy_rest where when content_types_provided
returned a media type with a wildcard as first in the list, and
a request comes in without an accept header, then the media_type
value in the Req object would contain '*' instead of [] for the
parameters.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
And additional minor tweaks.
|
|
|
|
|
|
|
|
|
|
Wrong option was being tested.
|
|
The examples test suite is only useful once in a while
in order to know whether examples were broken, for example
before issuing a release.
The new ws_autobahn test suite isolates the autobahn test
suite so that it can be ignored by default. It's only
useful to run it when working on the Websocket code or
before issuing a release.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Cowboy is 19+ so it's OK to use it.
|
|
It allows disabling the chunked transfer-encoding. It
can also be disabled on a per-request basis, although
it will be ignored for responses that are not streamed.
|
|
|
|
It allows overriding the idle_timeout option only for now.
|