allow configuring http2_max_local_error_reset_streams in linkerd-proxy

[bob-bins]

What problem are you trying to solve?

allow configuring http2_max_local_error_reset_streams in linkerd-proxy

How should the problem be solved?

Upgrade tonic package to 0.14.3 and expose max_local_error_reset_streams as a configurable if needed (I'm not sure right now if the tonic configurables are implicitly configurable in linkerd (e.g. using matching env vars) or not)

Any alternatives you've considered?

There are no alternatives that I know of

How would users interact with this feature?

No response

Would you like to work on this feature?

maybe

[cratelyn]

hi @bob-bins, thanks for filling an issue.

this seems like a reasonable feature request, but it would be helpful for the sake of prioritization on our end to understand what the motivation for this feature is. could you provide some more information about why the current defaults are not sufficient for any workloads you are running, or what benefits that making this configurable would provide?

in looking at the documentation for this interface in tonic, i see that it references this hyper issue: hyperium/hyper#2877. note this and this comment in particular:

Exactly; additionally, there is no world in which this is a "high severity" CVE. You can use this tool to calculate the severity.

Another update, this should be classified as low severity. The attack requires sufficient bandwidth to overload Hyper's accept loop. The original submitter 400 threads over localhost against hyper's 1 thread. This would not be easy to trigger over a network (though possible). Additionally, systems return to normal once the attack completes.

In practice, I don't expect many to be vulnerable to such an attack due to the difficulty of triggering it via remote network and in terms of severity, a botnet attack triggering a DOS by overloading the pipe would be a greater risk.