HTTP POST limiting advised to avoid Essex/Folsom Keystone DoS
---
### Summary ###
Concurrent Keystone POST requests with large body messages are held in memory without filtering or rate limiting, this can lead to resource exhaustion on the Keystone server.
### Discussion ###
Keystone stores POST messages in memory before validation, concurrent submission of multiple large POST messages can cause the Keystone process to be killed due to memory exhaustion, resulting in a remote Denial of Service.
In many cases Keystone will be deployed behind a load-balancer or proxy that can rate limit POST messages inbound to Keystone. Grizzly is protected against that through the sizelimit middleware.
### Recommended Actions ###
If you are in a situation where Keystone is directly exposed to incoming POST messages and not protected by the sizelimit middleware there are a number of load-balancing/proxy options, we suggest you consider one of the following:
HTTP POST limiting advised to avoid Essex/Folsom Keystone DoS
---
### Summary ###
Concurrent Keystone POST requests with large body messages are held in memory without filtering or rate limiting, this can lead to resource exhaustion on the Keystone server.
### Affected Services / Software ###
Keystone, Databases
### Discussion ###
Keystone stores POST messages in memory before validation, concurrent submission of multiple large POST messages can cause the Keystone process to be killed due to memory exhaustion, resulting in a remote Denial of Service.
In many cases Keystone will be deployed behind a load-balancer or proxy that can rate limit POST messages inbound to Keystone. Grizzly is protected against that through the sizelimit middleware.
### Recommended Actions ### proxy options, we suggest you consider one of the following:
If you are in a situation where Keystone is directly exposed to incoming POST messages and not protected by the sizelimit middleware there are a number of load-balancing/
Nginx: Open-source, high-performance HTTP server and reverse proxy. wiki.nginx. org/HttpCoreMod ule#client_ max_body_ size
Nginx Config: http://
Apache: HTTP Server Project httpd.apache. org/docs/ 2.4/mod/ core.html# limitrequestbod y
Apache Config: http://
### Contacts / References ### /bugs.launchpad .net/ossn/ +bug/1155566 /bugs.launchpad .net/keystone/ +bug/1098177 /launchpad. net/~openstack- ossg
This OSSN Bug: https:/
Original LaunchPad Bug : https:/
OpenStack Security ML : <email address hidden>
OpenStack Security Group : https:/