REGTESTS: add a test to prevent h2 desync attacks
This test ensure that h2 pseudo headers are properly checked for invalid
characters and the host header is ignored if :authority is present. This
is necessary to prevent h2 desync attacks as described here
https://portswigger.net/research/http2
(cherry picked from commit 7ef244d73b073edf3d493ed826ca1b0233c330e0)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 39faba79f254dac92668f4852db4ef67a8421658)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 838b9bf022a12cf91d31d7bfb87797c6742a4923)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit fafcab583d71cfd22b671dcb12aed7cf9e92c2a0)
[wt: adjusted for 2.0 (since most bugs/fixes not relevant there: uses
redirects with received hosts instead of return 200; rxrst and
400 replaced with check for 302 with valid original host for
scheme and path attacks on URI; auth vs host dropped]
Signed-off-by: Willy Tarreau <w@1wt.eu>
1 file changed