HTTP/2 Decoder validate that GOAWAY lastStreamId doesn't increase
Motivation: The HTTP/2 RFC states in https://tools.ietf.org/html/rfc7540#section-6.8 that Endpoints MUST NOT increase the value they send in the last stream identifier however we don't enforce this when decoding GOAWAY frames. Modifications: - Throw a connection error if the peer attempts to increase the lastStreamId in a GOAWAY frame Result: RFC is more strictly enforced.
This commit is contained in:
parent
3613d15bca
commit
df41be6fc8
@ -182,6 +182,10 @@ public class DefaultHttp2ConnectionDecoder implements Http2ConnectionDecoder {
|
|||||||
|
|
||||||
void onGoAwayRead0(ChannelHandlerContext ctx, int lastStreamId, long errorCode, ByteBuf debugData)
|
void onGoAwayRead0(ChannelHandlerContext ctx, int lastStreamId, long errorCode, ByteBuf debugData)
|
||||||
throws Http2Exception {
|
throws Http2Exception {
|
||||||
|
if (connection.goAwayReceived() && connection.local().lastStreamKnownByPeer() < lastStreamId) {
|
||||||
|
throw connectionError(PROTOCOL_ERROR, "lastStreamId MUST NOT increase. Current value: %d new value: %d",
|
||||||
|
connection.local().lastStreamKnownByPeer(), lastStreamId);
|
||||||
|
}
|
||||||
listener.onGoAwayRead(ctx, lastStreamId, errorCode, debugData);
|
listener.onGoAwayRead(ctx, lastStreamId, errorCode, debugData);
|
||||||
connection.goAwayReceived(lastStreamId, errorCode, debugData);
|
connection.goAwayReceived(lastStreamId, errorCode, debugData);
|
||||||
}
|
}
|
||||||
|
@ -628,6 +628,13 @@ public class DefaultHttp2ConnectionDecoderTest {
|
|||||||
verify(listener).onRstStreamRead(eq(ctx), anyInt(), anyLong());
|
verify(listener).onRstStreamRead(eq(ctx), anyInt(), anyLong());
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@Test(expected = Http2Exception.class)
|
||||||
|
public void goawayIncreasedLastStreamIdShouldThrow() throws Exception {
|
||||||
|
when(local.lastStreamKnownByPeer()).thenReturn(1);
|
||||||
|
when(connection.goAwayReceived()).thenReturn(true);
|
||||||
|
decode().onGoAwayRead(ctx, 3, 2L, EMPTY_BUFFER);
|
||||||
|
}
|
||||||
|
|
||||||
@Test(expected = Http2Exception.class)
|
@Test(expected = Http2Exception.class)
|
||||||
public void rstStreamReadForUnknownStreamShouldThrow() throws Exception {
|
public void rstStreamReadForUnknownStreamShouldThrow() throws Exception {
|
||||||
when(connection.streamMayHaveExisted(STREAM_ID)).thenReturn(false);
|
when(connection.streamMayHaveExisted(STREAM_ID)).thenReturn(false);
|
||||||
|
Loading…
x
Reference in New Issue
Block a user