[release-4.10]: UPSTREAM: 121120: Prevent rapid reset http2 DOS on API server #46
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dgrisonnet
changed the title
dgrisonnet
force-pushed
the
carry-121196-release-4.10
branch
from
373e257
to
3cf74ca
Compare
|
New changes are detected. LGTM label has been removed. |
Bumping golang.org/x/net in light of CVE-2023-39325 and CVE-2023-44487. Signed-off-by: Madhav Jivrajani <madhav.jiv@gmail.com> Kubernetes-commit: 3d980e0633d9043f1bc4e6a3141185fbece78183
This change fully addresses CVE-2023-44487 and CVE-2023-39325 for the API server when the client is unauthenticated. The changes to util/runtime are required because otherwise a large number of requests can get blocked on the time.Sleep calls. For unauthenticated clients (either via 401 or the anonymous user), we simply no longer allow such clients to hold open http2 connections. They can use http2, but with the performance of http1 (with keep-alive disabled). Since this change has the potential to cause issues, the UnauthenticatedHTTP2DOSMitigation feature gate can be disabled to remove this protection (it is enabled by default). For example, when the API server is fronted by an L7 load balancer that is set up to mitigate http2 attacks, unauthenticated clients could force disable connection reuse between the load balancer and the API server (many incoming connections could share the same backend connection). An API server that is on a private network may opt to disable this protection to prevent performance regressions for unauthenticated clients. For all other clients, we rely on the golang.org/x/net fix in golang/net@b225e7c That change is not sufficient to adequately protect against a motivated client - future changes to Kube and/or golang.org/x/net will be explored to address this gap. The Kube API server now uses a max stream of 100 instead of 250 (this matches the Go http2 client default). This lowers the abuse limit from 1000 to 400. Signed-off-by: Monis Khan <mok@microsoft.com> Kubernetes-commit: d40f08f4a44785c238c280a8ec4fb944928253ed Disable UnauthenticatedHTTP2DOSMitigation by default This makes backports safer by not changing any default behavior. Signed-off-by: Monis Khan <mok@microsoft.com> Kubernetes-commit: 8af7deedb176af04543ba53b1312d9771c53b6b4
dgrisonnet
force-pushed
the
carry-121196-release-4.10
branch
from
3cf74ca
to
50560e1
Compare
dgrisonnet
force-pushed
the
carry-121196-release-4.10
branch
from
50560e1
to
3d5a0d0
Compare
Enable the UnauthenticatedHTTP2DOSMitigation feature gate by default to mitigate the HTTP/2 CVE across all our components. Signed-off-by: Damien Grisonnet <dgrisonn@redhat.com>
dgrisonnet
force-pushed
the
carry-121196-release-4.10
branch
from
3d5a0d0
to
ca5a6e6
Compare
|
Closing as 4.10 is EOL. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
On top of the upstream cherry-pick bringing the HTTP/2 mitigation, this PR contains a carry patch to enable the UnauthenticatedHTTP2DOSMitigation feature gate by default.
proof: openshift/cluster-policy-controller#141