Welcome! Log In Create A New Profile

Advanced

Re: OT: Rapid Reset attacks on HTTP/2

Rick Gutierrez
October 12, 2023 11:48AM
good to know, thanks for the info Maxim.

El mar, 10 oct 2023 a las 17:55, Maxim Dounin (<mdounin@mdounin.ru>) escribi├│:
>
> Hello!
>
> On Tue, Oct 10, 2023 at 05:30:52PM -0400, Rick Gutierrez wrote:
>
> > In the open version 1.24 and 1.25 the correction will be applied?, ┬┐or in
> > the new release?
>
> To re-iterate:
>
> We do not consider nginx to be affected by this issue. In the
> default configuration, nginx is sufficiently protected by the
> limit of allowed requests per connection (see
> http://nginx.org/r/keepalive_requests for details), so an attacker
> will be required to reconnect very often, making the attack
> obvious and easy to stop at the network level. And it is not
> possible to circumvent the max concurrent streams limit in nginx,
> as nginx only allows additional streams when previous streams are
> completely closed.
>
> Further, additional protection can be implemented in nginx by
> using the "limit_req" directive, which limits the rate of requests
> and rejects excessive requests.
>
> Overall, with the handling as implemented in nginx, impact of
> streams being reset does no seem to be significantly different
> from impacts from over workloads with large number of requests
> being sent by the client, such as handling of multiple HTTP/2
> requests or HTTP/1.x pipelined requests.
>
> Nevertheless, we've decided to implemented some additional
> mitigations which will help nginx to detect such attacks and drop
> connections with misbehaving clients faster. The patch to do so
> was committed (http://hg.nginx.org/nginx/rev/cdda286c0f1b) and
> will be available in the next nginx release.
>
> --
> Maxim Dounin
> http://mdounin.ru/
> _______________________________________________
> nginx mailing list
> nginx@nginx.org
> https://mailman.nginx.org/mailman/listinfo/nginx



--
rickygm

http://gnuforever.homelinux.com
_______________________________________________
nginx mailing list
nginx@nginx.org
https://mailman.nginx.org/mailman/listinfo/nginx
Subject Author Posted

OT: Rapid Reset attacks on HTTP/2

noloader October 10, 2023 02:52PM

Re: OT: Rapid Reset attacks on HTTP/2

kapouer October 10, 2023 02:56PM

Re: OT: Rapid Reset attacks on HTTP/2

Maxim Dounin October 10, 2023 03:04PM

Re: OT: Rapid Reset attacks on HTTP/2

noloader October 10, 2023 03:48PM

Re: OT: Rapid Reset attacks on HTTP/2

Rick Gutierrez October 10, 2023 05:32PM

Re: OT: Rapid Reset attacks on HTTP/2

Maxim Dounin October 10, 2023 05:56PM

Re: OT: Rapid Reset attacks on HTTP/2

Rick Gutierrez October 12, 2023 11:48AM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 92
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready