Skip to content

build: bump nghttp2 to 1.41.0. (#11412)#11468

Merged
PiotrSikora merged 2 commits intoenvoyproxy:release/v1.12from
PiotrSikora:11412-to-v1.12
Jun 6, 2020
Merged

build: bump nghttp2 to 1.41.0. (#11412)#11468
PiotrSikora merged 2 commits intoenvoyproxy:release/v1.12from
PiotrSikora:11412-to-v1.12

Conversation

@PiotrSikora
Copy link
Contributor

@PiotrSikora PiotrSikora commented Jun 5, 2020

See release notes at
https://github.com/nghttp2/nghttp2/releases/tag/v1.41.0.

This addresses
GHSA-q5wr-xfw9-q7xr.

Set nghttp2 internal flood mitigation threshold back to 10K to avoid any
changes in Envoy's codec behavior.

Signed-off-by: Harvey Tuch htuch@google.com
Signed-off-by: Yan Avlasov yavlasov@google.com
Signed-off-by: Piotr Sikora piotrsikora@google.com

@PiotrSikora PiotrSikora requested a review from yanavlasov June 5, 2020 12:11
@PiotrSikora
Copy link
Contributor Author

PiotrSikora commented Jun 5, 2020

@yanavlasov this change results in failed Http2FloodMitigationTest.{Ping,Settings} tests in release/v1.12, but not in other branches, and I don't understand why... Any ideas?

@PiotrSikora PiotrSikora requested a review from htuch June 5, 2020 12:11
See release notes at
https://github.com/nghttp2/nghttp2/releases/tag/v1.41.0.

This addresses
GHSA-q5wr-xfw9-q7xr.

Set nghttp2 internal flood mitigation threshold back to 10K to avoid any
changes in Envoy's codec behavior.

Signed-off-by: Harvey Tuch <htuch@google.com>
Signed-off-by: Yan Avlasov <yavlasov@google.com>
Signed-off-by: Piotr Sikora <piotrsikora@google.com>
@PiotrSikora
Copy link
Contributor Author

@yanavlasov this change results in failed Http2FloodMitigationTest.{Ping,Settings} tests in release/v1.12, but not in other branches, and I don't understand why... Any ideas?

Nevermind, found it (#9158).

@PiotrSikora PiotrSikora marked this pull request as ready for review June 5, 2020 12:46
@PiotrSikora PiotrSikora merged commit c152887 into envoyproxy:release/v1.12 Jun 6, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants