Harden HTTP/2 client response flow control for large bodies - #952
Conversation
codeon:
version: 1
authority: FWN-370
description: |-
Fail closed on invalid WINDOW_UPDATE increments, overflow, idle/other-stream WINDOW_UPDATE, and connection-level DATA. Keep 32 KiB stream and connection WINDOW_UPDATE on non-final DATA so bodies larger than the 65535 window complete, while other-stream DATA remains ignored.
Add protocol tests for those violations plus DATA over the initial window, and a bounded h2c client/server round trip with a response body larger than 65535.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ce982333e8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } else { | ||
| Err(idle_window_update_error()) |
There was a problem hiding this comment.
When using emit_http2_upgrade, stream 1 represents the HTTP/1.1 upgrade request while the client opens stream 3, so a server may legally send a late WINDOW_UPDATE for stream 1 while it is half-closed or closed. This branch classifies every non-current stream as idle and aborts the otherwise valid stream-3 response; track the upgraded stream state and ignore permissible late updates rather than rejecting all other stream IDs.
Useful? React with 👍 / 👎.
1 participant
Harden the bounded h2c client so response bodies larger than the 65535 initial window complete with 32 KiB stream and connection WINDOW_UPDATE frames.
Fail closed on zero WINDOW_UPDATE increments, send-window overflow, idle or other-stream WINDOW_UPDATE, and connection-level DATA. Keep existing other-stream DATA ignore behavior.
Protocol tests cover invalid increments, overflow, stream mismatch, connection-level DATA, and DATA over the 65535 window. A client/server round trip with a body larger than 65535 passes, and existing bounded h2c tests remain passing.