HTTP/2 rapid reset attack impacting Nginx products

Important to note that unless your Nginx instance has a special (read: very high) keepalive limit configured, Nginx has a fairly reasonable defense against HTTP/2 rapid reset attack by default, as the article says. Still, interesting to see the response to these attacks.

Related. Others?<p><i>HAProxy is not affected by the HTTP&#x2F;2 Rapid Reset Attack</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37837043">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37837043</a> - Oct 2023 (31 comments)<p><i>The largest DDoS attack to date, peaking above 398M rps</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37831062">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37831062</a> - Oct 2023 (461 comments)<p><i>HTTP&#x2F;2 Rapid Reset: deconstructing the record-breaking attack</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37831004">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37831004</a> - Oct 2023 (22 comments)<p><i>HTTP&#x2F;2 zero-day vulnerability results in record-breaking DDoS attacks</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37830998">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37830998</a> - Oct 2023 (69 comments)<p><i>The novel HTTP&#x2F;2 &#x27;Rapid Reset&#x27; DDoS attack</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37830987">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37830987</a> - Oct 2023 (103 comments)

I’m stuck trying to figure out if this is technically desired behavior or not. If you were retroactively designing http&#x2F;2 with this knowledge, would you have done anything different?

FYI this is for the commercial nginx product, hastily purchased by F5 a few years back when software load balancers were annihilating their hardware offering.<p>Curious to see f5 still playing games with their own cve disclosure on the bigip product though...assigning it a mitre cw400 is just lying.<p><a href="https:&#x2F;&#x2F;my.f5.com&#x2F;manage&#x2F;s&#x2F;article&#x2F;K000137106" rel="nofollow noreferrer">https:&#x2F;&#x2F;my.f5.com&#x2F;manage&#x2F;s&#x2F;article&#x2F;K000137106</a>

From some first-hand experience over the last few months… these suggestions and patch will help prevent a single client from overwhelming an NGINX server, but it will do little to stop even a modest botnet from generating enough requests to be a problem. Keeping some state on IPs and downgrading those that exceed limits to HTTP&#x2F;1.1 I believe is the only effective defense. Tuning those thresholds to get them right is… challenging.

Hehe, when I heard about the attack a couple of days ago I was interested to know if Nginx was affected and did a search on Google for the CVE of that attack followed by the name of Nginx.<p>I didn’t find anything relevant so I assumed that Nginx was not affected.<p>Turns out that was not a good assumption :p

&gt; this vulnerability can be exploited to execute a denial-of-service attack<p>Title should contain this info.

&gt; layer 4 monitoring and alerting tools<p>What do you guys use? Anything foss and not an applicance?

If someone asked me how to &quot;speed up the web&quot;, I would not suggest &quot;use HTTP&#x2F;2&quot;. I would remove ads and other garbage. As a decades long non-popular browser and TCP client user, I can testify this works very effectively. I prefer to have full control over the resources that I request, whether text or binary, so no auto-loading resources, no Javascript-requested resources and no HTTP&#x2F;2 &quot;server push&quot;. The clients I use do not auto-load resources, run Javascript nor carry out &quot;server push&quot;. Works great for me. Web is not slow.<p>According to HTTP&#x2F;2 proponents, the protocol originated at an online advertising services company and was developed by companies that profit from sale and delivery of online advertising, HTTP&#x2F;2 was designed to &quot;speed up the web&quot;.<p>I respect that opinions on HTTP&#x2F;2 may differ. If someone loves HTTP&#x2F;2, then I respect that opinion. In return I ask that others respect opinions that may differ from their own, including mine. NB. This comment speaks only for the web user submitting it. It does not speak for other web users. IMHO, no HN commenter can speak for other web users either. Thank you.

What about the old and proven Apache? Is it affected?

How does HTTP&#x2F;1.1 stand up to the current attack?

Anyone know if it affects Caddy?

Just use HTTP&#x2F;1.1, it&#x27;s the final protocol.<p>Nothing Google or Microsoft does will dethrone it.<p>Forget the browser; use a C or Java client and HTTP.<p>If they block port 80, just use another port.<p>They cannot win.

Why the submission OP?<p>Lots of discussion and submissions related to this over the last few days, not to mention this submitted 2 days ago