4 ms·

> NOT affected: Nginx, Jetty, HAProxy, NetScaler, Varnish. [0] 0: https://nowotarski.info/http2-continuation-flood/ https://nowotarski.info/http2-continuation-

> NOT affected: Nginx, Jetty, HAProxy, NetScaler, Varnish. [0] 0: https://nowotarski.info/http2-continuation-flood/ https://nowotarski.info/http2-continuation-flood/

wtarreau 2y ago
In other words the ones that have long been contesting the use of CONTINUATION due to the risk of DoS 10 years ago. Just read any of the long threads there to get an idea, it's always about how to avoid the nasty CONTINUATION: https://lists.w3.org/Archives/Public/ietf-http-wg/2014JulSep/thread.html https://lists.w3.org/Archives/Public/ietf-http-wg/2014JulSep... If at least it had been accepted to forbid it after a non-full HEADERS frame it would have been more robust but it was perceived that the encoding job itself could have been harder (byte boundaries in compressors etc). BTW I find it funny how we "rediscover" the same stuff every 10 years. Recently it was the well-known RESET_STREAM flood, now the CONTINUATION, soon it will probably be DATA frames of length zero, then single-byte WINDOW_UPDATES, then INITIAL_WINDOW SETTINGS that cost a lot of CPU, etc. The world is just circling in this security circus, provided it's possible to assign a name and possibly a logo to a known problem...
bklyn11201 2y ago
What about Caddy? It's a great project that deserves it's own line ;)
- programd 2y ago
  On Ubuntu 22.04 LTS caddy from the Ubuntu apt repo is shown as on version 2.7.6 and built with Go 1.21.5. That version of Go does not have a fix for this issue. Caddy 2.7.6 is also the latest version released on GitHub. So no fix yet, but I think all that's needed is a recompile with the latest version of Go 1.22.2
  - nelse 2y ago
    I think that recompiling with upgraded Go will not solve the issue. It seems Caddy imports `golang.org/x/net/http2` and pins it to v0.22.0 which is vulnerable: https://github.com/caddyserver/caddy/issues/6219#issuecomment-2038265390 https://github.com/caddyserver/caddy/issues/6219#issuecommen....
    - thegeekpirate 2y ago
      Looks like it's been fixed if you recompile from master as of a few minutes ago

> NOT affected: Nginx, Jetty, HAProxy, NetScaler, Varnish. [0] 0: https://nowotarski.info/http2-continuation-flood/ https://nowotarski.info/http2-continuation-flood/

wtarreau 2y ago

In other words the ones that have long been contesting the use of CONTINUATION due to the risk of DoS 10 years ago. Just read any of the long threads there to get an idea, it's always about how to avoid the nasty CONTINUATION: https://lists.w3.org/Archives/Public/ietf-http-wg/2014JulSep/thread.html https://lists.w3.org/Archives/Public/ietf-http-wg/2014JulSep... If at least it had been accepted to forbid it after a non-full HEADERS frame it would have been more robust but it was perceived that the encoding job itself could have been harder (byte boundaries in compressors etc). BTW I find it funny how we "rediscover" the same stuff every 10 years. Recently it was the well-known RESET_STREAM flood, now the CONTINUATION, soon it will probably be DATA frames of length zero, then single-byte WINDOW_UPDATES, then INITIAL_WINDOW SETTINGS that cost a lot of CPU, etc. The world is just circling in this security circus, provided it's possible to assign a name and possibly a logo to a known problem...

bklyn11201 2y ago

What about Caddy? It's a great project that deserves it's own line ;)

programd 2y ago
On Ubuntu 22.04 LTS caddy from the Ubuntu apt repo is shown as on version 2.7.6 and built with Go 1.21.5. That version of Go does not have a fix for this issue. Caddy 2.7.6 is also the latest version released on GitHub. So no fix yet, but I think all that's needed is a recompile with the latest version of Go 1.22.2
- nelse 2y ago
  I think that recompiling with upgraded Go will not solve the issue. It seems Caddy imports `golang.org/x/net/http2` and pins it to v0.22.0 which is vulnerable: https://github.com/caddyserver/caddy/issues/6219#issuecomment-2038265390 https://github.com/caddyserver/caddy/issues/6219#issuecommen....
  - thegeekpirate 2y ago
    Looks like it's been fixed if you recompile from master as of a few minutes ago