You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Without a proxy to aggregate connections, AppScope can unintentionally act like a DDOS attack when configured to output data with network sockets, and when the process being scoped is forking/exec'ing child processes by the thousands. In cribl mode, every process that exists makes two outbound connections, one for standard metrics and events, and another for raw payload data.
Right now we don't expect to be sending payload data, so we've made this DDOS issue twice as bad as it needs to be when SCOPE_CRIBL_ENABLE is true.
By "don't expect to be sending payload data", I'm just observing:
o) SCOPE_PAYLOAD_ENABLE is false by default
o) There are three "internally defined" protocol definitions that are set up in src/state.c:initPayloadDetect().
None of these three protocol definitions set this payload flag.
o) Externally, in src/scope.yml, there are no protocol definitions by default. In addition, the payload flag is not set for any protocol definition example supplied in the comments. The payload flag of the protocol definitions are off by default.
Possibile solutions include:
only creating the connection if payloads are configured to be on
never create the payload connection, period
The text was updated successfully, but these errors were encountered:
So the least impactful solution seems to be 1. above.
In src/cfgutils.c:initCtl(), it's as simple as changing from if (cfgLogStreamEnable(cfg)) {
to if (cfgLogStreamEnable(cfg) && (cfgPayEnable(cfg) || protocolDefinitionsUsePayloads())) {
This handles the possibility that a protocol definition will try to forward on payload data even if cfgPayEnable() is false. This is needed because src/state.c:doProtocol() currently looks like this:
// Send payloads if enabled globally or by the detected protocol
if (cfgPayEnable(g_cfg.staticfg)
|| (net && net->protoProtoDef && net->protoProtoDef->payload)) {
extractPayload(sockfd, net, buf, len, src, dtype);
}
I chose to add to the existing transport integration test to cover the testing of this.
* (#896) Don't create a second SCOPE_CRIBL connection unless payloads could
be sent.
* (#896) Clean up resources at end of new transport integration test case.
Without a proxy to aggregate connections, AppScope can unintentionally act like a DDOS attack when configured to output data with network sockets, and when the process being scoped is forking/exec'ing child processes by the thousands. In cribl mode, every process that exists makes two outbound connections, one for standard metrics and events, and another for raw payload data.
Right now we don't expect to be sending payload data, so we've made this DDOS issue twice as bad as it needs to be when SCOPE_CRIBL_ENABLE is true.
By "don't expect to be sending payload data", I'm just observing:
o) SCOPE_PAYLOAD_ENABLE is false by default
o) There are three "internally defined" protocol definitions that are set up in src/state.c:initPayloadDetect().
None of these three protocol definitions set this payload flag.
o) Externally, in src/scope.yml, there are no protocol definitions by default. In addition, the payload flag is not set for any protocol definition example supplied in the comments. The payload flag of the protocol definitions are off by default.
Possibile solutions include:
The text was updated successfully, but these errors were encountered: