RE: Design Issue: Unknown Frame Type MUST IGNORE rule and Denial of Service Attacks

I raised a related issue with Martin, that the FINAL flag is valid in these ignored frames, and the ordering of those rules could lead to disagreement between the peers whether a given stream has been half-closed or not.  We might simply modify the text to say that the payload and frame-specific flags must be ignored, not the entire frame per se.

-----Original Message-----
From: James M Snell [mailto:jasnell@gmail.com] 
Sent: Friday, April 26, 2013 10:55 AM
To: ietf-http-wg@w3.org
Subject: Design Issue: Unknown Frame Type MUST IGNORE rule and Denial of Service Attacks

https://github.com/http2/http2-spec/issues/80#issuecomment-17089487


In the current draft (-02), we say that Unknown and unrecognized Frame types MUST be ignored by an endpoint. While this is ok in theory, this can be very dangerous in practice. Specifically, an attacking sender could choose to flood a recipient with a high number of junk frames that use a previously unused type code. Because of the MUST IGNORE rule, these would simply be discarded by the recipient but the damage will already have been done. Flow control actions could help mitigate the problem, but those are only partially effective.

Also, the order of processing here for error handling is not clear.

Let's say an attacker sends a HEADERS frame to the server initiating a stream. The server sends an RST_STREAM REFUSED_STREAM fully closing the stream. The attacker continues to send JUNK frames for the same stream ID. There are two conditions happening here:

1. The sender is sending frames for a closed stream, which ought to result in an RST_STREAM, but..

2. The frame type is unknown and unrecognized by the server so MUST be ignored.

Which condition takes precedence and how do we mitigate the possible attack vector on this one.

- James

Received on Friday, 26 April 2013 18:09:04 UTC