Set a tlsHandshakeTimeout for tlsListener - #22130
Conversation
Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>
|
/retest |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files
... and 18 files with indirect coverage changes @@ Coverage Diff @@
## main #22130 +/- ##
==========================================
+ Coverage 69.66% 69.71% +0.05%
==========================================
Files 449 449
Lines 38177 38179 +2
==========================================
+ Hits 26597 26618 +21
+ Misses 10148 10132 -16
+ Partials 1432 1429 -3 Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
| l.handshakeFailure(tlsConn, herr) | ||
| return | ||
| } | ||
| _ = tlsConn.SetDeadline(time.Time{}) |
There was a problem hiding this comment.
| _ = tlsConn.SetDeadline(time.Time{}) | |
| if err := tlsConn.SetDeadline(time.Time{}); err != nil { | |
| l.handshakeFailure(tlsConn, err) | |
| return | |
| } |
we can fast-fail here
There was a problem hiding this comment.
I intentionally ignore the err, to avoid breaking any existing behaviour. Even SetDeadline fails, we still continue to execute the check
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ahrtr, fuweid The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/cherry-pick release-3.7 |
|
/cherry-pick release-3.6 |
|
@ahrtr: new pull request created: #22141 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@ahrtr: new pull request created: #22142 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/cherry-pick release-3.5 |
|
@ahrtr: new pull request created: #22160 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Is there a security advisory for this? Unless I'm misunderstanding the description above, it sounds like this is a remote DOS vector even when mutual TLS is enabled?
Since the connection is tracked before the client even sends a hello, it sounds like enabling mtls would not be a mitigation? |
4 participants
Set a tlsHandshakeTimeout for tlsListener to resolve a security issue (see below).
A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).
cc @fuweid @ivanvc @serathius