Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Slow-Rate Attack bug #3945

Closed
Rains6 opened this issue Aug 16, 2023 · 6 comments · Fixed by #3951
Closed

Fix Slow-Rate Attack bug #3945

Rains6 opened this issue Aug 16, 2023 · 6 comments · Fixed by #3951
Assignees
Labels
kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt.

Comments

@Rains6
Copy link
Contributor

Rains6 commented Aug 16, 2023

What happened:
In karmada, both ReadTimeout and WriteTimeout are not configured on the server, will lead to slow-rate attacks.

What you expected to happen:
Fix Slow-Rate Attack

How to reproduce it (as minimally and precisely as possible):
eg:cmd/scheduler/app/scheduler.go line 209

Anything else we need to know?:

Environment:

  • Karmada version: v1.7.0.alpha3
  • kubectl-karmada or karmadactl version (the result of kubectl-karmada version or karmadactl version):
  • Others:
@Rains6 Rains6 added the kind/bug Categorizes issue or PR as related to a bug. label Aug 16, 2023
@RainbowMango
Copy link
Member

cc @zishen for help.

@zishen
Copy link
Member

zishen commented Aug 16, 2023

cc @zishen for help.

ok

@zishen
Copy link
Member

zishen commented Aug 16, 2023

Yes, we do have this problem.
slow attack includes slow post,slow headers and slow read. One way to avoid this is to place restrictions on http requests.
The k8s community is handled in the following way here .
I strongly recommend accepting this proposal. And I glant to do it.
@RainbowMango @XiShanYongYe-Chang

@XiShanYongYe-Chang
Copy link
Member

Hi @zishen You can assign this issue to yourself with the command /assign.
I noticed that Kubernetes not only sets the ReadTimeout but also other values. When making modifications, we can consider setting all the necessary values comprehensively.

@zishen
Copy link
Member

zishen commented Aug 16, 2023

Hi @zishen You can assign this issue to yourself with the command /assign. I noticed that Kubernetes not only sets the ReadTimeout but also other values. When making modifications, we can consider setting all the necessary values comprehensively.

ok,I'm gland to fix this bug.

/assign

@XiShanYongYe-Chang
Copy link
Member

It seems that we don't need to sync it to the previous branch, I will update the label to cleanup
/kind cleanup
/remove-kind bug

@karmada-bot karmada-bot added kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. and removed kind/bug Categorizes issue or PR as related to a bug. labels Aug 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants