0
Fork 0
mirror of https://github.com/ninenines/cowboy.git synced 2025-07-14 12:20:24 +00:00
cowboy/test/h2spec_SUITE.erl

89 lines
2.4 KiB
Erlang
Raw Normal View History

%% Copyright (c) 2017, Loïc Hoguin <essen@ninenines.eu>
%%
%% Permission to use, copy, modify, and/or distribute this software for any
%% purpose with or without fee is hereby granted, provided that the above
%% copyright notice and this permission notice appear in all copies.
%%
%% THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
%% WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
%% MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
%% ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
%% WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
%% ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
%% OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-module(h2spec_SUITE).
-compile(export_all).
-compile(nowarn_export_all).
-import(ct_helper, [config/2]).
-import(ct_helper, [doc/1]).
%% ct.
all() ->
[h2spec].
init_per_suite(Config) ->
case os:getenv("H2SPEC") of
false ->
{skip, "H2SPEC environment variable undefined."};
H2spec ->
case filelib:is_file(H2spec) of
false ->
{skip, "H2SPEC executable not found."};
true ->
cowboy_test:init_http(h2spec, #{
env => #{dispatch => init_dispatch()},
Fix HTTP/2 CVEs A number of HTTP/2 CVEs were documented recently: https://www.kb.cert.org/vuls/id/605641/ This commit, along with a few changes and additions in Cowlib, fix or improve protection against all of them. For CVE-2019-9511, also known as Data Dribble, the new option stream_window_data_threshold can be used to control how little the DATA frames that Cowboy sends can get. For CVE-2019-9516, also known as 0-Length Headers Leak, Cowboy will now simply reject streams containing 0-length header names. For CVE-2019-9517, also known as Internal Data Buffering, the backpressure changes were already pretty good at preventing this issue, but a new option max_connection_buffer_size was added for even better control over how much memory we are willing to allocate. For CVE-2019-9512, also known as Ping Flood; CVE-2019-9515, also known as Settings Flood; CVE-2019-9518, also known as Empty Frame Flooding; and similar undocumented scenarios, a frame rate limiting mechanism was added. By default Cowboy will now allow 1000 frames every 10 seconds. This can be configured via max_received_frame_rate. For CVE-2019-9514, also known as Reset Flood, another rate limiting mechanism was added and can be configured via max_reset_stream_rate. By default Cowboy will do up to 10 stream resets every 10 seconds. Finally, nothing was done for CVE-2019-9513, also known as Resource Loop, because Cowboy does not currently implement the HTTP/2 priority mechanism (in parts because these issues were well known from the start). Tests were added for all cases except Internal Data Buffering, which I'm not sure how to test, and Resource Loop, which is not currently relevant.
2019-10-02 10:44:45 +02:00
max_concurrent_streams => 100,
%% Disable the DATA threshold for this test suite.
stream_window_data_threshold => 0
}, Config)
end
end.
end_per_suite(_Config) ->
cowboy:stop_listener(h2spec).
%% Dispatch configuration.
init_dispatch() ->
cowboy_router:compile([
{'_', [
{"/", delay_hello_h, 50}
]}
]).
%% Tests.
h2spec(Config) ->
doc("h2spec test suite for the HTTP/2 protocol."),
Self = self(),
spawn_link(fun() -> start_port(Config, Self) end),
receive
{h2spec_exit, 0, Log} ->
ct:log("~ts", [Log]),
ok;
{h2spec_exit, Status, Log} ->
ct:log("~ts", [Log]),
error({exit_status, Status})
end.
start_port(Config, Pid) ->
H2spec = os:getenv("H2SPEC"),
ListenPort = config(port, Config),
Port = open_port(
2018-05-16 10:50:09 +02:00
{spawn, H2spec ++ " -S -p "
++ integer_to_list(ListenPort)},
[{line, 10000}, {cd, config(priv_dir, Config)}, binary, exit_status]),
receive_infinity(Port, Pid, []).
receive_infinity(Port, Pid, Acc) ->
receive
{Port, {data, {eol, Line}}} ->
io:format(user, "~s~n", [Line]),
receive_infinity(Port, Pid, [Line|Acc]);
{Port, {exit_status, Status}} ->
Pid ! {h2spec_exit, Status, [[L, $\n] || L <- lists:reverse(Acc)]}
end.