3 ms·

I somewhat wish there was a way to test if any http2 server is vulnerable to these issues: * https://godoc.org/golang.org/x/net/http2 https://godoc.org/golang.

I somewhat wish there was a way to test if any http2 server is vulnerable to these issues: * https://godoc.org/golang.org/x/net/http2 https://godoc.org/golang.org/x/net/http2 * https://www.haproxy.com/blog/haproxy-1-9-has-arrived/ https://www.haproxy.com/blog/haproxy-1-9-has-arrived/ * https://repo1.maven.org/maven2/org/eclipse/jetty/http2/ https://repo1.maven.org/maven2/org/eclipse/jetty/http2/ * etc… Larger list at https://en.wikipedia.org/wiki/HTTP/2#Server_software https://en.wikipedia.org/wiki/HTTP/2#Server_software

Exuma 7y ago
I'm also wondering about golang http2
- 140am 7y ago
  https://github.com/golang/go/issues/33631 https://github.com/golang/go/issues/33631 (this is part of go 1.12.8 and 1.11.13 which got released because of this today)
LinuxBender 7y ago
This was the response from Willy for haproxy: Yes, just discussed them with Piotr. Not really concerned in practice, maybe only the 1st one (1-byte window increments) might have a measurable CPU impact but the rest is irrelevant to haproxy but could possibly harm some implementations depending how they are implemented of course. I use haproxy to provide http/2 and ALPN for my site, so if there is a PoC I will test it.
kodablah 7y ago
At least for the PING flood I think you can just send HTTP/2 PINGs over and over (that's what the Go test case does) and confirm it uses more and more resources as it queues the control messages.