From 0c39ce4b3a7f35a703dbe04df33fd6ccea801483 Mon Sep 17 00:00:00 2001 From: Stavros Kontopoulos Date: Mon, 23 Oct 2023 19:09:42 +0300 Subject: [PATCH] Allow to disable http2 for the webhook (#2877) --- webhook/webhook.go | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/webhook/webhook.go b/webhook/webhook.go index 779d388d22..dd6bc36e11 100644 --- a/webhook/webhook.go +++ b/webhook/webhook.go @@ -67,6 +67,17 @@ type Options struct { // GracePeriod is how long to wait after failing readiness probes // before shutting down. GracePeriod time.Duration + + // EnableHTTP2 enables HTTP2 for webhooks. + // Mitigate CVE-2023-44487 by disabling HTTP2 by default until the Go + // standard library and golang.org/x/net are fully fixed. + // Right now, it is possible for authenticated and unauthenticated users to + // hold open HTTP2 connections and consume huge amounts of memory. + // See: + // * https://github.com/kubernetes/kubernetes/pull/121120 + // * https://github.com/kubernetes/kubernetes/issues/121197 + // * https://github.com/golang/go/issues/63417#issuecomment-1758858612 + EnableHTTP2 bool } // Operation is the verb being operated on @@ -219,11 +230,18 @@ func (wh *Webhook) Run(stop <-chan struct{}) error { QuietPeriod: wh.Options.GracePeriod, } + // If TLSNextProto is not nil, HTTP/2 support is not enabled automatically. + nextProto := map[string]func(*http.Server, *tls.Conn, http.Handler){} + if wh.Options.EnableHTTP2 { + nextProto = nil + } + server := &http.Server{ Handler: drainer, Addr: fmt.Sprint(":", wh.Options.Port), TLSConfig: wh.tlsConfig, ReadHeaderTimeout: time.Minute, //https://medium.com/a-journey-with-go/go-understand-and-mitigate-slowloris-attack-711c1b1403f6 + TLSNextProto: nextProto, } eg, ctx := errgroup.WithContext(ctx)