Skip to content

Pseudo-header with empty value results in RST_STREAM with PROTOCOL_ERROR reason#13238

Merged
chrisvest merged 3 commits intonetty:4.1from
violetagg:4.1
Apr 16, 2023
Merged

Pseudo-header with empty value results in RST_STREAM with PROTOCOL_ERROR reason#13238
chrisvest merged 3 commits intonetty:4.1from
violetagg:4.1

Conversation

@violetagg
Copy link
Copy Markdown
Member

Motivation:

According to RFC9113
https://datatracker.ietf.org/doc/html/rfc9113#section-8.3.1
Pseudo-header :path must not have empty value.

Modifications:

  • Extend DefaultHttp2Headers#validateValue with validation for pseudo-header :path
  • Add junit test

Result:

Pseudo-header :path with empty value results in RST_STREAM with PROTOCOL_ERROR reason.

Related to #13235

@violetagg
Copy link
Copy Markdown
Member Author

@normanmaurer @chrisvest @idelpivnitskiy I added this validation to DefaultHttp2Headers#validateValue. Do we want to limit it just to HpackDecoder?

@normanmaurer
Copy link
Copy Markdown
Member

@violetagg I think its fine... lets wait for @idelpivnitskiy @chrisvest

Copy link
Copy Markdown
Member

@chrisvest chrisvest left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DefaultHttp2Headers is the correct place to validate this. The HpackDecoder should only validate stuff that go across multiple headers or are specific to the request type.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to protect this validation by a configuration flag to make sure users can disable it.

Taking into account the RFC requirements to always run this validation (at least by default), the fact that validateValues == false by default, I would propose to use validate flag that controls header name validation. While in practice the check validates a value, I would say that technically it's a "validation of a preudo-header name". The purpose of validateValues is quite different. It's disabled by default because it will cause significant perf overhead for most users.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please check the new commit.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Taking into account the RFC requirements to always run this validation (at least by default), the fact that validateValues == false by default, I would propose to use validate flag that controls header name validation.

@idelpivnitskiy Is this "always" requirement any different from checking that byte ranges for values are valid, which we skip by default?

Copy link
Copy Markdown
Member

@idelpivnitskiy idelpivnitskiy Feb 23, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The biggest differences are:

  1. the cost associated with a check
  2. how likely is it to hit the problem (messing up with pseudo-headers seems more likely)
  3. how it will affect the h2-protocol related flow vs user's business logic (having a bad char in some header won't impact h2 codec or h2->h1 transition)
  4. is the header name required to perform the check

This case seems to me close to TE header validation we have in HpackDecoder.

@violetagg violetagg changed the title Pseudo-header :path with empty value results in RST_STREAM with PROTOCOL_ERROR reason Pseudo-header with empty value results in RST_STREAM with PROTOCOL_ERROR reason Feb 23, 2023
Copy link
Copy Markdown
Member

@idelpivnitskiy idelpivnitskiy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@violetagg
Copy link
Copy Markdown
Member Author

Will this change be available with the next Netty version?

…COL_ERROR reason

Motivation:
According to RFC9113 https://datatracker.ietf.org/doc/html/rfc9113#section-8.3.1
Pseudo-header ':path' must not have empty value.

Modifications:
- Extend DefaultHttp2Headers#validateValue with validation for pseudo-header :path
- Add junit test

Result:
Pseudo-header :path with empty value results in RST_STREAM with PROTOCOL_ERROR reason.

Related to netty#13235
Perform the validation only when pseudo headers is enabled.
@chrisvest chrisvest merged commit 1314ede into netty:4.1 Apr 16, 2023
chrisvest pushed a commit to chrisvest/netty that referenced this pull request Apr 17, 2023
…ROR reason (netty#13238)

Motivation:
According to RFC9113 https://datatracker.ietf.org/doc/html/rfc9113#section-8.3.1
Pseudo-header ':path' must not have empty value.

Modifications:
- Extend DefaultHttp2Headers#validateValue with validation for pseudo-header :path
- Add junit test

Result:
Pseudo-header :path with empty value results in RST_STREAM with PROTOCOL_ERROR reason.

Related to netty#13235
violetagg added a commit to reactor/reactor-netty that referenced this pull request Apr 26, 2023
- Exclude tests in Http2ConnectionInforTests with HOST header empty
netty/netty#13238
- Fix unix domain socket tests in HttpServerTests as local and remote addresses are now available
netty/netty#13323
violetagg added a commit to reactor/reactor-netty that referenced this pull request Apr 26, 2023
- Exclude tests in Http2ConnectionInforTests with HOST header empty
netty/netty#13238
- Fix unix domain socket tests in HttpServerTests as local and remote addresses are now available
netty/netty#13323
violetagg added a commit to reactor/reactor-netty that referenced this pull request Apr 26, 2023
- Exclude tests in Http2ConnectionInforTests with HOST header empty
netty/netty#13238
- Fix unix domain socket tests in HttpServerTests as local and remote addresses are now available
netty/netty#13323
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants