The vulnerability can only be exploited if HTTP/2 support is enabled. Where it\nis, it can be disabled
\nat runtime by issuing vinyladm param.set feature -http2
persistently by removing -p feature=+http2 from the vinyld startup\nparameters
Note that HTTP/2 typically requires a TLS offloader, which must be changed to no\nlonger send the h2 ALPN. For example with haproxy, in the\nlisten/bind configuration directive, alpn h2,http/1.1 should be\nreplaced with alpn http/1.1.
This method requires vmod_re2.
\nvmod_re2 header filters (see the tutorial for more information) can be\nused to remove injected invalid header lines, which are the vehicle required for\nlaunching desync attacks exploiting this vulnerability.
\nTo the best of our knowledge, the following VCL snippet at the top of the custom\nVCL adds protection by removing invalid headers:
\n## BEGIN vsv19 mitigation\n#\nimport re2;\nsub vcl_init {\n new sane = re2.set(anchor=start, case_sensitive=false);\n # https://httpwg.org/specs/rfc9110.html#rule.token.separators\n # SLIGHTLY more relaxed, because it allows trailing SP / HTAB\n sane.add(\"[-!#$%&'*+.^_`|~a-z0-9]+:[\\s\\x21-\\x7E\\x80-\\xff]+$\");\n}\nsub vcl_recv {\n sane.hdr_filter(req, true);\n}\n#\n## END vsv19 mitigation\nTo the best of our knowledge, where vmod_re2 is already used with a\nhdr_filter in allow mode (second argument true), protection is already\nsufficient unless the empty string is allowed.
For versions 7.6.0 and higher, this method requires no additional VMODs, but\nneeds inline-C to be enabled.
\nFor Vinyl Cache:
\nat runtime by issuing vinyladm param.set vcc_feature +allow_inline_c
persistently by adding -p vcc_feature=+allow_inline_c to the vinyld\nstartup parameters
For Varnish Cache:
\nat runtime by issuing varnishadm param.set vcc_feature +allow_inline_c
persistently by adding -p vcc_feature=+allow_inline_c to the varnishd\nstartup parameters
Besides enabling inline-C, the following snippet needs to be added at the top of\nthe custom VCL:
\n## BEGIN vsv19 mitigation\n#\nsub recv_vsv19 {\n unset req.http.vsv19;\n if (req.proto != \"HTTP/2.0\" || ! req.http.content-length) {\n return;\n }\n set req.http.vsv19 = \"1\";\n C{\n VRT_SetHdr(ctx, &VGC_HDR_REQ_content_2d_length, 0,\n TOSTRAND(VRT_GetHdr(ctx, &VGC_HDR_REQ_content_2d_length)));\n }C\n}\nsub vcl_recv {\n call recv_vsv19;\n}\nsub vcl_backend_fetch {\n if (bereq.http.vsv19) {\n set bereq.http.Connection = \"close\";\n }\n}\n#\n## END vsv19 mitigation\nIn addition, care must be taken that bereq.http.Connection is not unset\nanywhere else in the custom VCL.
For version 6.0 LTS, this method works in pure VCL with no other changes\nrequired. The following snippet needs to be added at the top of the custom VCL:
\n## BEGIN vsv19 mitigation\n#\nsub recv_vsv19 {\n unset req.http.vsv19;\n if (req.proto != \"HTTP/2.0\" || ! req.http.content-length) {\n return;\n }\n set req.http.vsv19 = \"1\";\n set req.http.content-length = req.http.content-length;\n}\nsub vcl_recv {\n call recv_vsv19;\n}\nsub vcl_backend_fetch {\n if (bereq.http.vsv19) {\n set bereq.http.Connection = \"close\";\n }\n}\n#\n## END vsv19 mitigation\nIn addition, care must be taken that bereq.http.Connection is not unset\nanywhere else in the custom VCL.