Subject: Security Condideration of initial SETTINGS_MAX_CONCURRENT_STREAMS

From: Shigeki Ohtsu <[email-masked]>
Date: Wed, 15 Jan 2014 10:55:04 +0900

Hi,

In the current spec, an initial value of SETTINGS_MAX_CONCURRENT_STREAMS
is no limit and many of endpoints set it at the first SETTINGS.

A malicious client can send massive HEADERS without replying SETTINGS-ACK
in order to overflow server's stream sessions until SETTINGS_TIMEOUT
error or up to max stream-id.

This might be a case of ENHANCE_YOUR_CALM error as in "10.5 Denial of
Service Considerations" but some implementers would miss its protection
against DoS streams at the initial startup because they expect to receive
SETTINGS-ACK promptly and do not care that the max concurrent stream is
 unlimited.

One idea is to define an initial SETTINGS_MAX_CONCURRENT_STREAMS such as 100
which is recommended as minimum in the current spec.
Is there any reason not to define it?

If limiting of the inital value is a bad idea, it is better to write a
description in the security section to care against the DoS at the connection
startup.

Regards,

---

From: Martin Thomson <[email-masked]>
Date: Wed, 15 Jan 2014 09:47:24 -0800

> Is there any reason not to define it?

I've always wondered the same thing.

Is there anyone out there who thinks it possible to even get 100
requests into the second round trip TCP congestion window for any
reasonable use case?

---

From: Roberto Peon <[email-masked]>
Date: Wed, 15 Jan 2014 09:51:35 -0800

We've actually discussed this in the past, IIRC.
Yes, we've seen this limit exceeded in the first roundtrip at least once.

This is precisely one of the cases for ENHANCE_YOUR_CALM.
If the server doesn't like a large number of streams and does want to
serve, it can RST them.
The basic issue here being that we prefer to avoid HOL blocking until it is
explicitly signaled that it is needed.
-=R

---

From: Martin Thomson <[email-masked]>
Date: Wed, 15 Jan 2014 10:02:57 -0800

> Yes, we've seen this limit exceeded in the first roundtrip at least once.

Out of interest, with an initial congestion window of 32, 10, or 4?

---

From: Roberto Peon <[email-masked]>
Date: Wed, 15 Jan 2014 10:37:05 -0800

Unknown.
IIRC, this was a page load (probably refresh) after the connection had
idled out.
-=R

---

From: Shigeki Ohtsu <[email-masked]>
Date: Thu, 16 Jan 2014 10:08:08 +0900

(2014/01/16 2:51), Roberto Peon wrote:
> If the server doesn't like a large number of streams and does want to serve, it can RST them.
> The basic issue here being that we prefer to avoid HOL blocking until it is explicitly signaled that it is needed.

I've just submitted an issue to add a description of this DoS case
in the security section as

https://github.com/http2/http2-spec/issues/343

Regards,