projects / haproxy-2.3.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: e1eb08c) | patch
REGTESTS: add a test to prevent h2 desync attacks
authorAmaury Denoyelle <adenoyelle@haproxy.com>
Fri, 13 Aug 2021 07:43:24 +0000 (09:43 +0200)
committerWilly Tarreau <w@1wt.eu>
Tue, 17 Aug 2021 08:38:25 +0000 (10:38 +0200)
commit838b9bf022a12cf91d31d7bfb87797c6742a4923
tree5a830f267f07fe8613834c2ad6ac27b76240d474tree | snapshot
parente1eb08cde83d59bf4b1ea109b6dd8577a4505a1dcommit | diff
REGTESTS: add a test to prevent h2 desync attacks

This test ensure that h2 pseudo headers are properly checked for invalid
characters and the host header is ignored if :authority is present. This
is necessary to prevent h2 desync attacks as described here
https://portswigger.net/research/http2

(cherry picked from commit 7ef244d73b073edf3d493ed826ca1b0233c330e0)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 39faba79f254dac92668f4852db4ef67a8421658)
Signed-off-by: Willy Tarreau <w@1wt.eu>
reg-tests/http-messaging/h2_desync_attacks.vtc [new file with mode: 0644] blob
haproxy-2.3 public tree. Stable production code.