1291814 - enforce increasing h2 push ids

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Patrick McManus [:mcmanus]]

There is a public blackhat attack today against h2 servers where stream ids are recycled instead of being always increasing. It looks like they got a server to have a UAF problem.

The same technique could be used against the client via server push - we don't enforce that the stream ids are increasing.

however I'm pretty confident nothing particularly bad would happen - if the stream still existed we would reset the push (so you wouldn't be able to attach and then wait for it to be freed prematurely), and if the stream no longer existed we would accept it but it would go through the normal lifecycle just like if it were a bigger ID.

nonetheless, its not cool and 7540 tells us to reset the connection with protocol error in this case. Let's do that.

Comment 1

[Patrick McManus [:mcmanus]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=d7960b51ce21

Comment 2

[Patrick McManus [:mcmanus]]

Attachment: enforce h2 increasing push ids

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4563f1ee1d06
enforce h2 increasing push ids. r=hurley

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/4563f1ee1d06