Limit max reset frames to mitigate HTTP/2 RST floods #5232

ikhoon · 2023-10-11T11:14:28Z

Motivation:

To mitigate against the "HTTP/2 Rapid Reset" attack, it is recommended that HTTP/2 servers should close connections that exceed the concurrent stream limit.

Reference:

Modifications:

Add ServerBuilder.http2MaxRestFramesPerWindow() option and -Dcom.linecorp.armeria.defaultHttp2MaxResetFramesPerMinute<integer> property to limit the maximum allowed RST frames.
- If not set, 400 RST frames per minute are allowed by default.
Bump Netty version to 4.1.100 from 4.1.96

Result:

You can now protect your server against DDOS caused by RST floods.

Server
  .builder()
  .http2MaxResetFramesPerWindow(100, 10)
  .build();

Motivation: To mitigate against the "HTTP/2 Rapid Reset" attack, it is recommended that HTTP/2 servers should close connections that exceed the concurrent stream limit. Reference: - https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ - https://www.cve.org/CVERecord?id=CVE-2023-44487 - netty/netty@58f75f6#diff-82f568a075ff63e9727ce8622f3a2b1553099182edf1fd0b4f857226252b05adR47 Modifications: - Add `ServerBuilder.http2MaxRestFramesPerWindow()` option `-Dcom.linecorp.armeria.defaultHttp2MaxResetFramesPerMinute<integer>` property to limit the maximum allowed RST frames. - If not set, 400 RST frames per minute are alllowed by default. - Bump Netty version to 4.1.100 from 4.1.96 Result: You can now protect your server against DDOS caused by RST floods. ```java Server .builder() .http2MaxResetFramesPerWindow(100, 10) .build(); ```

github-actions · 2023-10-11T12:29:01Z

🔍 Build Scan® (commit: `1ee478b`)

Job name	Status	Build Scan®
build-self-hosted-jdk-8	✅	https://ge.armeria.dev/s/iroz76uhi5pz4
build-self-hosted-jdk-19-snapshot-blockhound	✅	https://ge.armeria.dev/s/xy42ruijca34i

codecov · 2023-10-11T13:39:24Z

Codecov Report

Attention: 4 lines in your changes are missing coverage. Please review.

Comparison is base (f93ccca) 74.21% compared to head (1ee478b) 74.08%.
Report is 12 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #5232      +/-   ##
============================================
- Coverage     74.21%   74.08%   -0.14%     
- Complexity    19858    19978     +120     
============================================
  Files          1705     1717      +12     
  Lines         73185    73600     +415     
  Branches       9357     9366       +9     
============================================
+ Hits          54311    54523     +212     
- Misses        14436    14643     +207     
+ Partials       4438     4434       -4

Files	Coverage Δ
.../linecorp/armeria/common/DefaultFlagsProvider.java	`86.90% <100.00%> (+0.15%)`	⬆️
...ava/com/linecorp/armeria/common/FlagsProvider.java	`96.92% <100.00%> (+0.04%)`	⬆️
...rp/armeria/common/SystemPropertyFlagsProvider.java	`63.94% <100.00%> (+0.24%)`	⬆️
...m/linecorp/armeria/server/DefaultServerConfig.java	`59.56% <100.00%> (+0.51%)`	⬆️
...ia/server/Http2ServerConnectionHandlerBuilder.java	`100.00% <100.00%> (ø)`
...java/com/linecorp/armeria/server/ServerConfig.java	`0.00% <ø> (ø)`
...linecorp/armeria/server/UpdatableServerConfig.java	`89.28% <100.00%> (+0.39%)`	⬆️
...c/main/java/com/linecorp/armeria/common/Flags.java	`74.42% <75.00%> (+<0.01%)`	⬆️
...ava/com/linecorp/armeria/server/ServerBuilder.java	`82.89% <62.50%> (+0.45%)`	⬆️

... and 54 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

minwoox

Looks great!

minwoox · 2023-10-12T03:45:47Z

core/src/main/java/com/linecorp/armeria/common/Flags.java

@@ -1032,6 +1036,22 @@ public static long defaultHttp2MaxHeaderListSize() {
        return DEFAULT_HTTP2_MAX_HEADER_LIST_SIZE;
    }

+    /**
+     * Returns the default maximum number RST frames that are allowed per window before the connection is


nit: number of

minwoox · 2023-10-12T03:46:47Z

core/src/main/java/com/linecorp/armeria/common/FlagsProvider.java

@@ -694,6 +694,22 @@ default Long defaultHttp2MaxHeaderListSize() {
        return null;
    }

+    /**
+     * Returns the default maximum number RST frames that are allowed per window before the connection is


jrhee17

Thanks for the quick fix @ikhoon ! 🙇 👍 🙇

core/src/main/java/com/linecorp/armeria/common/Flags.java

core/src/main/java/com/linecorp/armeria/common/FlagsProvider.java

core/src/main/java/com/linecorp/armeria/server/ServerBuilder.java

Co-authored-by: jrhee17 <guins_j@guins.org>

core/src/main/java/com/linecorp/armeria/server/ServerConfig.java

minwoox · 2023-10-18T08:25:54Z

👍 👍 👍

Motivation: To mitigate against the "HTTP/2 Rapid Reset" attack, it is recommended that HTTP/2 servers should close connections that exceed the concurrent stream limit. Reference: - https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ - https://www.cve.org/CVERecord?id=CVE-2023-44487 - netty/netty@58f75f6#diff-82f568a075ff63e9727ce8622f3a2b1553099182edf1fd0b4f857226252b05adR47 Modifications: - Add `ServerBuilder.http2MaxRestFramesPerWindow()` option and `-Dcom.linecorp.armeria.defaultHttp2MaxResetFramesPerMinute<integer>` property to limit the maximum allowed RST frames. - If not set, 400 RST frames per minute are allowed by default. - Bump Netty version to 4.1.100 from 4.1.96 Result: You can now protect your server against DDOS caused by RST floods. ```java Server .builder() .http2MaxResetFramesPerWindow(100, 10) .build(); ```

ikhoon added defect dependencies labels Oct 11, 2023

ikhoon added this to the 1.26.0 milestone Oct 11, 2023

ikhoon requested review from jrhee17, minwoox and trustin as code owners October 11, 2023 11:14

Fix flaky

43ce20e

minwoox approved these changes Oct 12, 2023

View reviewed changes

of

2663c40

jrhee17 approved these changes Oct 13, 2023

View reviewed changes

ikhoon and others added 3 commits October 18, 2023 12:25

Update core/src/main/java/com/linecorp/armeria/common/Flags.java

f84beb8

Co-authored-by: jrhee17 <guins_j@guins.org>

Update core/src/main/java/com/linecorp/armeria/common/FlagsProvider.java

98f0e87

Co-authored-by: jrhee17 <guins_j@guins.org>

Update core/src/main/java/com/linecorp/armeria/server/ServerBuilder.java

6723cc2

Co-authored-by: jrhee17 <guins_j@guins.org>

minwoox reviewed Oct 18, 2023

View reviewed changes

core/src/main/java/com/linecorp/armeria/server/ServerConfig.java Outdated Show resolved Hide resolved

Update core/src/main/java/com/linecorp/armeria/server/ServerConfig.java

1ee478b

minwoox merged commit 4121cf5 into line:main Oct 18, 2023
14 of 15 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Limit max reset frames to mitigate HTTP/2 RST floods #5232

Limit max reset frames to mitigate HTTP/2 RST floods #5232

ikhoon commented Oct 11, 2023

github-actions bot commented Oct 11, 2023 •

edited

codecov bot commented Oct 11, 2023 •

edited

minwoox left a comment

minwoox Oct 12, 2023

minwoox Oct 12, 2023

jrhee17 left a comment

minwoox commented Oct 18, 2023

Limit max reset frames to mitigate HTTP/2 RST floods #5232

Limit max reset frames to mitigate HTTP/2 RST floods #5232

Conversation

ikhoon commented Oct 11, 2023

github-actions bot commented Oct 11, 2023 • edited

🔍 Build Scan® (commit: 1ee478b)

codecov bot commented Oct 11, 2023 • edited

Codecov Report

minwoox left a comment

Choose a reason for hiding this comment

minwoox Oct 12, 2023

Choose a reason for hiding this comment

minwoox Oct 12, 2023

Choose a reason for hiding this comment

jrhee17 left a comment

Choose a reason for hiding this comment

minwoox commented Oct 18, 2023

github-actions bot commented Oct 11, 2023 •

edited

🔍 Build Scan® (commit: `1ee478b`)

codecov bot commented Oct 11, 2023 •

edited