Enhanced PHP File Manager

⬆️ Go Up (..)

📊 Server Information

Server:

nginx/1.28.0

System:

Linux 6.8.0-90-generic

PHP Version:

8.4.15

User:

alqudsvolunteers

Directory:

/home/alqudsvolunteers/rootlink/proc/thread-self/root/proc/self/root/usr/share/doc/varnish/html/phk

Free Space:

80.01 GB

🔧 Quick Actions

✏️ Editing: h2againagainagain.html

<!DOCTYPE html>

<title>On the deck-chairs of HTTP/2 &#8212; Varnish version 7.5.0 documentation</title>
    <link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=fa44fd50" />
    <link rel="stylesheet" type="text/css" href="../_static/classic.css?v=e2714048" />
    
    <script src="../_static/documentation_options.js?v=8214db13"></script>
    <script src="../_static/doctools.js?v=888ff710"></script>
    <script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
    
    <link rel="index" title="Index" href="../genindex.html" />
    <link rel="search" title="Search" href="../search.html" />
    <link rel="next" title="How Varnish met CHERI 7/N" href="cheri7.html" />
    <link rel="prev" title="Poul-Hennings random outbursts" href="index.html" /> 
  </head><body>
    <div class="related" role="navigation" aria-label="related navigation">
      <h3>Navigation</h3>
      <ul>
        <li class="right" style="margin-right: 10px">
          <a href="../genindex.html" title="General Index"
             accesskey="I">index</a></li>
        <li class="right" >
          <a href="cheri7.html" title="How Varnish met CHERI 7/N"
             accesskey="N">next</a> |</li>
        <li class="right" >
          <a href="index.html" title="Poul-Hennings random outbursts"
             accesskey="P">previous</a> |</li>
        <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 7.5.0 documentation</a> &#187;</li>
          <li class="nav-item nav-item-1"><a href="index.html" accesskey="U">Poul-Hennings random outbursts</a> &#187;</li>
        <li class="nav-item nav-item-this"><a href="">On the deck-chairs of HTTP/2</a></li> 
      </ul>
    </div>

<div class="document">
      <div class="documentwrapper">
        <div class="bodywrapper">
          <div class="body" role="main">
            
  <section id="on-the-deck-chairs-of-http-2">
<span id="phk-h2-again-again-again"></span><h1>On the deck-chairs of HTTP/2<a class="headerlink" href="#on-the-deck-chairs-of-http-2" title="Link to this heading">¶</a></h1>
<p>Last week some people found out that the HTTP/2 protocol is not so
fantastic when it comes to Denial-of-Service attacks.</p>
<p>Funny that.</p>
<p>The DoS vulnerability “found” last week, and proudly declared
“zero-day” in the heroic sagas of supreme DevOps-ness, can be found
in section 6.5.2, page 38 bottom, of RFC7540, from 2015:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>SETTINGS_MAX_CONCURRENT_STREAMS (0x3):  Indicates the maximum number
   of concurrent streams that the sender will allow.  This limit is
   directional: it applies to the number of streams that the sender
   permits the receiver to create.  Initially, there is no limit to
   this value.  It is recommended that this value be no smaller than
   100, so as to not unnecessarily limit parallelism.
</pre></div>
</div>
<p>Long before that RFC was made official, some of us warned about
<code class="docutils literal notranslate"><span class="pre">there</span> <span class="pre">is</span> <span class="pre">no</span> <span class="pre">limit</span></code>, but that would not be a problem because “We
have enough CPU’s for that”, we were told, mainly by the people
from the very large company who pushed H2 down our throat.</p>
<p>Overall HTTP/2 has been a solid disappointment, at least if you
believed any of the lofty promises and hype used to market it.</p>
<p>Yes, we got fewer TCP connections, which is nice when there are
only sixty-something thousand port numbers available, and yes we
got some parallelism per TCP connection.</p>
<p>Of course the price for that parallelism is that a dropped
packet no longer delays a single resource:  Now it delays <em>everything</em>.</p>
<p>During the ratification period, this got the nickname
“Head-Of-Line-Blocking” or just “HoL-blocking”, but that would also
not be a problem because “the ISPs would be forced to (finally) fix
that” - said some guy with a Google Fiber connection to his Silly
Valley home.</p>
<p>But we also got, as people “discovered” last week, a lot more
sensitive to DoS attacks - by design - because the entire point
of H2 was to get as much work done as soon as possible.</p>
<p>Then there is the entire section in the H2 RFC about “Stream
Priority”, intended to reduce the risk of people reading the
words in the article until all the “monetization” were in place.</p>
<p>As far as I know, nobody ever got that to do anything useful,
unless they had somebody standing on the toes 24*7, pointing their
nose at the ever-moving moon, while reciting Chaucer from memory.
I think all browsers just ignore it now.</p>
<p>Oh… and “PUSH”:  The against-all-principles reverse primitive, so
the server could tell the browser, that come hell or high water,
you will need these advertisements right away.</p>
<p>Nobody got that working either.</p>
<p>But my all time personal favorite is this one:</p>
<p>The static HPACK compression table contains entries for the headers
<code class="docutils literal notranslate"><span class="pre">proxy-authentication</span></code> and <code class="docutils literal notranslate"><span class="pre">proxy-authorization</span></code>, which by
definition can never appear in a H2 connection.  But they were in
some random dataset somebody used to construct the table, and “it
was far too late to change that now”, because we were in a hurry
to get H2 deployed.</p>
<p>We have a saying in Danish: »Hastværk er lastværk«, which roughly
translates to »Hurry and be Sorry«, and well, yeah…</p>
<p>(If you want to read what I thought at the time, this is a draft
I never completed because I realized that H2 was just going to be a
rubber-stamping exercise: <a class="reference external" href="https://phk.freebsd.dk/sagas/httpbis/">https://phk.freebsd.dk/sagas/httpbis/</a>)</p>
<p>Once it became clear that H2 would happen, DoS vulnerabilities and
all, I dialed down my complaining about the DoS problems, partly
because I saw no reason to actively tell the script-kiddies and
criminals what to do, but mostly because clearly nobody was listening:
“It’s a bypass.  You’ve got to build bypasses.”</p>
<p>Somewhat reluctantly we implemented H2 in Varnish, because people
told us they really, really would need this, it was going to be a
checkbox item for the C-team once they read about it in the WSJ,
and all the cool kids already had it &amp;c &amp;c.</p>
<p>We didn’t do a bad job of it, but we could probably have done it
even better, if we had felt it would worth it.</p>
<p>But given that the ink on H2 was barely dry before QUIC was being
launched to replace it, and given that DoS vulnerabilities were
literally written into the standard, we figured that H2 was unlikely
to overtake the hot plate and the deep water as Inventions of The
Century, and economized our resources accordingly.</p>
<p>I am pleasantly surprised that it took the bad guys this long to
weaponize H2.  Yes, there are 100 pages in the main RFC and neither
Hemmingway or Prachett were on the team, but eight years ?  Of
course there is no knowing how long time it has been a secret weapon
in some country’s arsenal of “cyber weapons”.</p>
<p>But now that the bad guys have found it, and weaponized it, what do we do ?</p>
<p>My advice:</p>
<p>Unless you have solid numbers to show that H2 is truly improving
things for you and your clients, you should just turn it off.
Remember to also remove it from the ALPN string in hitch or whatever
TLS off-loader you use.</p>
<p>If for some reason you cannot turn H2 off, we are implementing some
parameters which can help mitigate the DoS attacks, and we will
roll new releases to bring those to you.</p>
<p>But other than that, please do not expect us to spend a lot of time
rearranging the deck-chairs of HTTP/2.</p>
<p><em>/phk</em></p>
</section>

<div class="clearer"></div>
          </div>
        </div>
      </div>
      <div class="sphinxsidebar" role="navigation" aria-label="main navigation">
        <div class="sphinxsidebarwrapper">
  <div>
    <h4>Previous topic</h4>
    <p class="topless"><a href="index.html"
                          title="previous chapter">Poul-Hennings random outbursts</a></p>
  </div>
  <div>
    <h4>Next topic</h4>
    <p class="topless"><a href="cheri7.html"
                          title="next chapter">How Varnish met CHERI 7/N</a></p>
  </div>
  <div role="note" aria-label="source link">
    <h3>This Page</h3>
    <ul class="this-page-menu">
      <li><a href="../_sources/phk/h2againagainagain.rst.txt"
            rel="nofollow">Show Source</a></li>
    </ul>
   </div>
<div id="searchbox" style="display: none" role="search">
  <h3 id="searchlabel">Quick search</h3>
    <div class="searchformwrapper">
    <form class="search" action="../search.html" method="get">
      <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
      <input type="submit" value="Go" />
    </form>
    </div>
</div>
<script>document.getElementById('searchbox').style.display = "block"</script>
        </div>
      </div>
      <div class="clearer"></div>
    </div>
    <div class="related" role="navigation" aria-label="related navigation">
      <h3>Navigation</h3>
      <ul>
        <li class="right" style="margin-right: 10px">
          <a href="../genindex.html" title="General Index"
             >index</a></li>
        <li class="right" >
          <a href="cheri7.html" title="How Varnish met CHERI 7/N"
             >next</a> |</li>
        <li class="right" >
          <a href="index.html" title="Poul-Hennings random outbursts"
             >previous</a> |</li>
        <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 7.5.0 documentation</a> &#187;</li>
          <li class="nav-item nav-item-1"><a href="index.html" >Poul-Hennings random outbursts</a> &#187;</li>
        <li class="nav-item nav-item-this"><a href="">On the deck-chairs of HTTP/2</a></li> 
      </ul>
    </div>
    <div class="footer" role="contentinfo">
    &#169; Copyright 2010-2014, Varnish Software AS.
      Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.2.6.
    </div>
  </body>
</html>

❌ Cancel

🗂️ Enhanced PHP File Manager

📊 Server Information

🔧 Quick Actions

✏️ Editing: h2againagainagain.html

📤 Upload File

📁 Create Folder

📄 Create File

✏️ Rename Item

🗑️ Delete Confirmation