Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HAProxy is not affected by the HTTP/2 Rapid Reset Attack

haproxy.com

Post reply on HN
Print view View original

1–10 of 36 posts

Re: HAProxy is not affected by the HTTP/2 Rapid Reset Attack

#3

Post by stygiansonic » 

    After rigorous testing, we have been able to confirm that our implementation of the HTTP/2 protocol can handle the Rapid Reset Attack without increasing the resource usage or compromising the parallelism of the protocol.
But doesn’t this mean the servers behind the reverse proxy would still suffer from increased/wasted resources responding to the rapid reset requests?

Re: HAProxy is not affected by the HTTP/2 Rapid Reset Attack

#4

Post by notRobot »

tick_tock_tick wrote: post #2

[flagged]

> After rigorous testing, we have been able to confirm that our implementation of the HTTP/2 protocol can handle the Rapid Reset Attack without increasing the resource usage or compromising the parallelism of the protocol.

You are free to conduct your own tests? AFAIK the software in question is free (both libre and commercially).

Re: HAProxy is not affected by the HTTP/2 Rapid Reset Attack

#5

Post by tpmx »

I'm quite impressed with HAProxy.

It takes a little effort to fully understand the configuration file format (hint: you've got to read the documentation, not just look at examples to fully grok it), but it's so worth it, IMO.

It's also a nice treat to have the founder and technical leader (Willy Tarreau) of the HAProxy company being so active in the community, so many years later (the initital release was in 2001). I regularly see him answering e.g. newbie questions.

(HAProxy docs: https://docs.haproxy.org/ - pick 2.8/LTS)

Re: HAProxy is not affected by the HTTP/2 Rapid Reset Attack

#6

Post by chatmasta »

More details [0] about the mitigation are discussed on the mailing list:

> So at first glance we indeed addressed this case in 2018 (1.9-dev) with this commit:

> f210191dc ("BUG/MEDIUM: h2: don't accept new streams if conn_streams are still in excess")

> It was incomplete by then an later refined, but the idea is there. But I'll try to stress that area again to see.

[0] https://www.mail-archive.com/haproxy@formilux.org/msg44134.h...

Re: HAProxy is not affected by the HTTP/2 Rapid Reset Attack

#9

Post by lillecarl »

stygiansonic wrote: post #3

After rigorous testing, we have been able to confirm that our implementation of the HTTP/2 protocol can handle the Rapid Reset Attack without increasing the resource usage or compromising the parallelism of the protocol. But doesn’t this mean the servers behind the reverse proxy would still suffer from increased/wasted resources responding to the rapid reset requests?

If you're doing tcp load balancing sure, but http is terminated at the proxy and wouldn't be vulnerable. This is why you put $proxy or $webbserver in front of your application webserver.
Post reply on HN