nghttp2/nghttp2
1
0
Fork 0
mirror of https://github.com/nghttp2/nghttp2.git synced 2025-12-10 03:58:53 +08:00
Code Issues Projects Releases Wiki Activity

Limit the number of incoming reserved (remote) streams

Browse Source 
RFC 7540 does not enforce any limit on the number of incoming reserved
streams (in RFC 7540 terms, streams in reserved (remote) state).  This
only affects client side, since only server can push streams.
Malicious server can push arbitrary number of streams, and make
client's memory exhausted.  The new option,
nghttp2_set_max_reserved_remote_streams, can set the maximum number of
such incoming streams to avoid possible memory exhaustion.  If this
option is set, and pushed streams are automatically closed on
reception, without calling user provided callback, if they exceed the
given limit.  The default value is 200.  If session is configured as
server side, this option has no effect.  Server can control the number
of streams to push.
This commit is contained in:
Tatsuhiro Tsujikawa
2015-08-23 21:22:25 +09:00
parent 647e30619f
commit 928a81885c
6 changed files with 128 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
lib/includes/nghttp2/nghttp2.h
View File

@@ -2031,6 +2031,25 @@ nghttp2_option_set_no_recv_client_magic(nghttp2_option *option, int val);
NGHTTP2_EXTERN void nghttp2_option_set_no_http_messaging(nghttp2_option *option,
int val);
/**
* @function
*
* RFC 7540 does not enforce any limit on the number of incoming
* reserved streams (in RFC 7540 terms, streams in reserved (remote)
* state). This only affects client side, since only server can push
* streams. Malicious server can push arbitrary number of streams,
* and make client's memory exhausted. This option can set the
* maximum number of such incoming streams to avoid possible memory
* exhaustion. If this option is set, and pushed streams are
* automatically closed on reception, without calling user provided
* callback, if they exceed the given limit. The default value is
* 200. If session is configured as server side, this option has no
* effect. Server can control the number of streams to push.
*/
NGHTTP2_EXTERN void
nghttp2_option_set_max_reserved_remote_streams(nghttp2_option *option,
uint32_t val);
/**
* @function
*