Damien Neil 491a49abca http2: cap the size of the server's canonical header cache ...

The HTTP/2 server keeps a per-connection cache mapping header keys
to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the
maximum size of this cache to prevent a peer sending many unique
header keys from causing unbounded memory growth.

Cap chosen arbitrarily at 32 entries. Since this cache does not
include common headers (e.g., "content-type"), 32 seems like more
than enough for almost all normal uses.

Fixes #50058
Fixes CVE-2021-44716

Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://go-review.googlesource.com/c/net/+/369794
Trust: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Trust: Damien Neil <dneil@google.com>
Reviewed-by: Russ Cox <rsc@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>

2021-12-09 12:49:13 +00:00

..

h2c

all: fix typos

2021-07-26 21:34:35 +00:00

h2i

all: go fmt ./...

2021-02-20 03:31:24 +00:00

hpack

http2: number of allocs reduced from 3852 to 31

2021-10-13 15:36:59 +00:00

testdata

all: fix typos

2021-07-26 21:34:35 +00:00

.gitignore

…

ascii_test.go

http2: switch to ASCII equivalents of string functions

2021-05-10 09:51:57 +00:00

ascii.go

http2: check that Unicode-aware functions are not used

2021-06-10 13:23:58 +00:00

ciphers_test.go

http2: fix format argument warnings in tests

2017-07-11 18:12:19 +00:00

ciphers.go

all: use HTTPS for iana.org links

2018-01-24 06:09:56 +00:00

client_conn_pool.go

http2: avoid clientConnPool panic when NewClientConn fails

2021-10-05 00:13:12 +00:00

databuffer_test.go

http2: remove support for Go 1.8 and earlier

2018-11-01 15:51:06 +00:00

databuffer.go

http2: replace fixedBuffer with dataBuffer

2017-02-24 20:07:17 +00:00

Dockerfile

http2: update curl download location in Dockerfile

2021-04-14 19:42:28 +00:00

errors_test.go

http2: update copyright headers

2015-10-14 04:32:53 +00:00

errors.go

http2: add Transport.CountErrors

2021-09-17 21:38:27 +00:00

flow_test.go

http2: correct overflow protection

2018-06-28 19:26:13 +00:00

flow.go

http2: mark some structs as non-comparable

2020-05-01 05:30:45 +00:00

frame_test.go

http2: accept zero-length block fragments in HEADERS frames

2021-09-02 16:59:21 +00:00

frame.go

http2: wire up Transport and Server's CountError to frame parser code

2021-09-28 04:43:08 +00:00

go111.go

all: go fmt ./...

2021-02-20 03:31:24 +00:00

go115.go

crypto/tls: don't use tls.Dialer on pre-Go1.15 systems

2021-05-05 21:49:59 +00:00

gotrack_test.go

http2: reset DebugGoroutines after testing it

2015-12-21 12:44:09 +00:00

gotrack.go

http2: update copyright headers

2015-10-14 04:32:53 +00:00

headermap.go

http2: switch to ASCII equivalents of string functions

2021-05-10 09:51:57 +00:00

http2_test.go

http2: check that Unicode-aware functions are not used

2021-06-10 13:23:58 +00:00

http2.go

http2: mark some structs as non-comparable

2020-05-01 05:30:45 +00:00

Makefile

…

not_go111.go

all: go fmt ./...

2021-02-20 03:31:24 +00:00

not_go115.go

crypto/tls: don't use tls.Dialer on pre-Go1.15 systems

2021-05-05 21:49:59 +00:00

pipe_test.go

http2: track unread bytes when the pipe is broken

2019-10-14 20:34:26 +00:00

pipe.go

http2: refactor request write flow

2021-10-04 16:44:53 +00:00

server_push_test.go

http2: remove support for Go 1.8 and earlier

2018-11-01 15:51:06 +00:00

server_test.go

http2: fix TLS1.0 and TLS1.1 rejection tests

2021-11-08 17:07:45 +00:00

server.go

http2: cap the size of the server's canonical header cache

2021-12-09 12:49:13 +00:00

transport_go117_test.go

http2: use (*tls.Dialer).DialContext in dialTLS

2021-05-04 13:21:25 +00:00

transport_test.go

http2: deflake TestTransportGroupsPendingDials

2021-12-08 01:23:54 +00:00

transport.go

net/http2: Fix handling of expect continue

2021-12-01 19:05:59 +00:00

write.go

http2: switch to ASCII equivalents of string functions

2021-05-10 09:51:57 +00:00

writesched_priority_test.go

http2: fix nits found by vet

2017-01-07 18:04:02 +00:00

writesched_priority.go

all: fix typos

2019-09-09 00:30:24 +00:00

writesched_random_test.go

http2: prioritize RST_STREAM frames in random write scheduler

2021-12-08 00:02:02 +00:00

writesched_random.go

http2: prioritize RST_STREAM frames in random write scheduler

2021-12-08 00:02:02 +00:00

writesched_test.go

http2: prioritize RST_STREAM frames in random write scheduler

2021-12-08 00:02:02 +00:00

writesched.go

http2: prioritize RST_STREAM frames in random write scheduler

2021-12-08 00:02:02 +00:00

z_spec_test.go

x/net/http2: Fix various typos in doc comments.

2016-09-16 03:37:56 +00:00