Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid HashDoS attacks via random per-session hash initial state #1433

Merged
merged 6 commits into from Nov 10, 2022

Conversation

marty1885
Copy link
Collaborator

@marty1885 marty1885 commented Nov 9, 2022

This patch randomizes the hash parameters for HTTP request and response classes per session. This avoids HashDoS attacks while not causing tremendous performance overhead.

Other approaches we considered includes

  • map instead of unordered_map
  • unordered_map<map<string, string>>
  • cryptographically secure hashes for key
  • etc..

But all methods above causes more performance loss then this. We will be making a new release very soon after this PR being merged in order for our users to avoid the vulnerability.

Also, this introduces an API break as the return type of parameters() is no longer std::unordered_map<std::string, std::string>(). However in our survey (of the projects that the maintainers run). That API is rarely used and can be easily updated by using auto or updating the return type.

We'd like to attribute @itrofimow for discovering the issue

@marty1885 marty1885 changed the title [WIP] hash colision avoidance 2 Avoid HashDoS attacks via ransom per-session hash initial state Nov 9, 2022
@marty1885 marty1885 changed the title Avoid HashDoS attacks via ransom per-session hash initial state Avoid HashDoS attacks via random per-session hash initial state Nov 10, 2022
@an-tao an-tao merged commit c0d48da into master Nov 10, 2022
7 checks passed
@an-tao an-tao deleted the hash-colision-avoidance-random-seed branch November 10, 2022 05:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants