chenBright opened a new pull request, #3524:
URL: https://github.com/apache/brpc/pull/3524
### What problem does this PR solve?
Issue Number: resolve
Problem Summary:
`CaseIgnoredHasher` (headers) and `DefaultHasher` (query map) are both
plain
`result = result * 101 + c` with no per-process seed, and `FlatMap` picks a
bucket by masking the low bits of the hash. An attacker only needs the low
`log2(nbucket)` bits to match, which is brute-forceable offline in seconds
and
reusable against every process, since nothing is seeded.
Both maps then degrade to a single chain:
- `on_header_value()` calls `GetOrAddHeader()` for every field, so each
header
costs a linear scan of the chain built so far. The cost is on the lookup
side
and is paid unconditionally on the parse hot path.
- `URI::ParseQueries()` inserts through `FlatMap::operator[]`, which walks
the
chain to dedup. The cost is on the insert side.
Either one turns a single request into O(n^2) work in the server's IO path.
Nothing bounded `n`: h1 had no field-count limit at all, and h2's
`max_header_list_size` bounds the decoded *bytes* of a header block, not
the
number of fields in it.
### What is changed and the side effects?
Changed:
Tomcat's `maxHeaderCount`, Envoy's `max_request_headers_count`, PHP's
`max_input_vars`, Django's `DATA_UPLOAD_MAX_NUMBER_FIELDS` and
Tomcat 11's `maxParameterCount`, all of which were introduced as hashDoS
mitigations.
Therefore, two flags are introduced to bound the number of http headers
and
query parameters per message:
- `-http_max_header_count` (default 100), checked in
`HttpMessage::on_header_value()` for h1 and in
`H2StreamContext::ConsumeHeaders()` after `AppendHeader()` for h2.
- `-http_max_query_count` (default 1000), checked in `URI::SetHttpURL()`
for h1
and in `URI::SetH2Path()` for h2. It counts `&` separators rather than
map
entries: the splitter walks every segment even when the keys repeat, and
it is
that walk the limit is meant to bound.
Setting flag to <= 0 lifts the limit.
Side effects:
- Performance effects:
- Breaking backward compatibility:
---
### Check List:
- Please make sure your changes are compilable.
- When providing us with a new feature, it is best to add related tests.
- Please follow [Contributor Covenant Code of
Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
