Re: Slow read attack in HTTP/2

2016-08-22 Thread Valentin V. Bartenev
On Monday 22 August 2016 12:40:46 Sharan J wrote: > Hi, > > The scenario which I mentioned was only tested and reported by imperva and > Nginx has said that they have solved this slow read issue. > References: > http://www.imperva.com/docs/Imperva_HII_HTTP2.pdf > https://www.nginx.com/blog/the-imp

Re: Slow read attack in HTTP/2

2016-08-22 Thread Sharan J
Hi, The scenario which I mentioned was only tested and reported by imperva and Nginx has said that they have solved this slow read issue. References: http://www.imperva.com/docs/Imperva_HII_HTTP2.pdf https://www.nginx.com/blog/the-imperva-http2-vulnerability-report-and-nginx/ But as you say, the

Re: Slow read attack in HTTP/2

2016-08-19 Thread Валентин Бартенев
On Friday 19 August 2016 18:07:46 Sharan J wrote: > Hi, > > Thanks for the response. > > Would like to know what happens in the following scenario, > > Client sets its initial congestion window size to be very small and > requests for a large data. It updates the window size everytime when it >

Re: Slow read attack in HTTP/2

2016-08-19 Thread Sharan J
t it cause DOS? Thanks, Sharan On Fri, Aug 19, 2016 at 5:28 PM, Valentin V. Bartenev wrote: > On Friday 19 August 2016 17:06:41 Sharan J wrote: > > Hi, > > > > Would like to know what timeouts should be configured to mitigate slow > read > > attack in HTTP/2. >

Re: Slow read attack in HTTP/2

2016-08-19 Thread Valentin V. Bartenev
On Friday 19 August 2016 17:06:41 Sharan J wrote: > Hi, > > Would like to know what timeouts should be configured to mitigate slow read > attack in HTTP/2. > A quote from the commit: | Now almost all the request timeouts work like in HTTP/1.x connections, so | the "c

Slow read attack in HTTP/2

2016-08-19 Thread Sharan J
Hi, Would like to know what timeouts should be configured to mitigate slow read attack in HTTP/2. Referred -> https://trac.nginx.org/nginx/changeset/4ba91a4c66a3010e50b84fc73f05e84619396885/nginx?_ga=1.129092111.226709851.1453970886 Could not understand what you have done when all streams