-
Notifications
You must be signed in to change notification settings - Fork 378
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
h2: Rapid reset mitigations (7.4) #4009
Commits on Oct 18, 2023
-
Configuration menu - View commit details
-
Copy full SHA for ce3c6b5 - Browse repository at this point
Copy the full SHA ce3c6b5View commit details -
h2: Add a rate limit facility for h/2 RST handling
This adds parameters h2_rst_allowance and h2_rst_allowance_period, which govern the rate of which we allow clients to reset h/2 streams. If the limit is exceeded the connection is closed. Mitigates: varnishcache#3996
Configuration menu - View commit details
-
Copy full SHA for 9dda589 - Browse repository at this point
Copy the full SHA 9dda589View commit details -
Configuration menu - View commit details
-
Copy full SHA for 856e2fd - Browse repository at this point
Copy the full SHA 856e2fdView commit details -
Only RST frames received earlier than this duration will be considered rapid.
Configuration menu - View commit details
-
Copy full SHA for 5eb4c5c - Browse repository at this point
Copy the full SHA 5eb4c5cView commit details -
Configuration menu - View commit details
-
Copy full SHA for 56eded7 - Browse repository at this point
Copy the full SHA 56eded7View commit details -
Configuration menu - View commit details
-
Copy full SHA for cbadf10 - Browse repository at this point
Copy the full SHA cbadf10View commit details -
Configuration menu - View commit details
-
Copy full SHA for 0e37f4f - Browse repository at this point
Copy the full SHA 0e37f4fView commit details -
vtc: Avoid cycling the barrier in t02014
It was particularly hard to follow once we reach client c3.
Configuration menu - View commit details
-
Copy full SHA for 727882c - Browse repository at this point
Copy the full SHA 727882cView commit details -
The goal is for top-level transports to report whether the client is still present or not.
Configuration menu - View commit details
-
Copy full SHA for a983f4b - Browse repository at this point
Copy the full SHA a983f4bView commit details -
vcl_vrt: Skip VCL execution if the client is gone
Once a client is reportedly gone, processing its VCL task(s) is just a waste of resources. The execution of client-facing VCL is intercepted and an artificial return(fail) is returned in that scenario. Thanks to the introduction of the universal return(fail) proper error handling and resource tear down is already in place, which makes this change safe modulus unknown bugs. This adds a circuit breaker anywhere in the client state machine where there is VCL execution. A new Reset time stamp is logged to convey when a task does not complete because the client is gone. This is a good complement to the walk away feature and its original circuit breaker for the waiting list, but this has not been integrated yet. While the request is technically failed, it won't increase the vcl_fail counter, and a new req_reset counter is incremented. This new behavior is guarded by a new vcl_req_reset feature flag, enabled by default. Refs varnishcache#3835 Refs 61a15cb Refs e5efc2c Refs ba54dc9 Refs 6f50a00 Refs b881699
Configuration menu - View commit details
-
Copy full SHA for 2c5b14a - Browse repository at this point
Copy the full SHA 2c5b14aView commit details -
http2_session: Implement transport polling
The error check is not performed in a critical section to avoid contention, at the risk of not seeing the error until the next transport poll.
Configuration menu - View commit details
-
Copy full SHA for 6ecc9ec - Browse repository at this point
Copy the full SHA 6ecc9ecView commit details -
vtc: Stabilize r3996 and increase coverage
With varnishcache#3998 we need to ensure streams are not going to skip vcl_recv if reset faster than reaching this step for the request task. The alternative to prevent the vcl_req_reset feature from interfering is to simply disable it.
Configuration menu - View commit details
-
Copy full SHA for b27f508 - Browse repository at this point
Copy the full SHA b27f508View commit details -
vtc: Missing synchronization in t02025
Noticed while porting varnishcache#3998 to the 6.0 branch with a varnishtest more sensitive to timing.
Configuration menu - View commit details
-
Copy full SHA for e3847e1 - Browse repository at this point
Copy the full SHA e3847e1View commit details -
Copy rapid reset parameters to the h2 session
This will allow per-session adjustments and also significantly lower the risk of inconsistent calculations in the rate limit code during parameter changes. Ref varnishcache#3996
Configuration menu - View commit details
-
Copy full SHA for e12a088 - Browse repository at this point
Copy the full SHA e12a088View commit details -
Configuration menu - View commit details
-
Copy full SHA for b0301c5 - Browse repository at this point
Copy the full SHA b0301c5View commit details -
Start with a reasonable default for h2_rapid_reset_limit
as agreed on IRC.
Configuration menu - View commit details
-
Copy full SHA for 498adbd - Browse repository at this point
Copy the full SHA 498adbdView commit details -
Configuration menu - View commit details
-
Copy full SHA for f1c044c - Browse repository at this point
Copy the full SHA f1c044cView commit details -
we can not make the parameter const because API.
Configuration menu - View commit details
-
Copy full SHA for eb8aed1 - Browse repository at this point
Copy the full SHA eb8aed1View commit details