umgeher/cowboy
0
Fork 0
mirror of https://github.com/ninenines/cowboy.git synced 2025-07-14 04:10:24 +00:00
Code Issues Wiki Activity

Add max_fragmented_header_block_size HTTP/2 option

Browse source
This commit is contained in:
Loïc Hoguin 2024-03-14 12:36:54 +01:00
parent 81f3a21474
commit cf71c742d6
No known key found for this signature in database
GPG key ID: 8A9DF795F6FED764
5 changed files with 46 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

35
test/security_SUITE.erl
View file

@ -33,13 +33,14 @@ groups() ->
Tests = [nc_rand, nc_zero],
H1Tests = [slowloris, slowloris_chunks],
H2CTests = [
http2_cancel_flood,
http2_data_dribble,
http2_empty_frame_flooding_data,
http2_empty_frame_flooding_headers_continuation,
http2_empty_frame_flooding_push_promise,
http2_infinite_continuations,
http2_ping_flood,
http2_reset_flood,
http2_cancel_flood,
http2_settings_flood,
http2_zero_length_header_leak
],
@ -219,6 +220,38 @@ http2_empty_frame_flooding_push_promise(Config) ->
{ok, <<_:24, 7:8, _:72, 1:32>>} = gen_tcp:recv(Socket, 17, 6000),
ok.
http2_infinite_continuations(Config) ->
doc("Confirm that Cowboy rejects CONTINUATION frames when the "
"total size of HEADERS + CONTINUATION(s) exceeds the limit."),
{ok, Socket} = rfc7540_SUITE:do_handshake(Config),
%% Send a HEADERS frame followed by a large number
%% of continuation frames.
{HeadersBlock, _} = cow_hpack:encode([
{<<":method">>, <<"GET">>},
{<<":scheme">>, <<"http">>},
{<<":authority">>, <<"localhost">>}, %% @todo Correct port number.
{<<":path">>, <<"/">>}
]),
HeadersBlockLen = iolist_size(HeadersBlock),
ok = gen_tcp:send(Socket, [
%% HEADERS frame.
<<
HeadersBlockLen:24, 1:8, 0:5,
0:1, %% END_HEADERS
0:1,
1:1, %% END_STREAM
0:1,
1:31 %% Stream ID.
>>,
HeadersBlock,
%% CONTINUATION frames.
[<<1024:24, 9:8, 0:8, 0:1, 1:31, 0:1024/unit:8>>
|| _ <- lists:seq(1, 100)]
]),
%% Receive an ENHANCE_YOUR_CALM connection error.
{ok, <<_:24, 7:8, _:72, 11:32>>} = gen_tcp:recv(Socket, 17, 6000),
ok.
%% @todo http2_internal_data_buffering(Config) -> I do not know how to test this.
% doc("Request many very large responses, with a larger than necessary window size, "
% "but do not attempt to read from the socket. (CVE-2019-9517)"),