Reject malformed HTTP/3 requests with a stream error - #6
Open
xl32 wants to merge 1 commit into
Open
Conversation
RFC 9114 4.1.2 requires a malformed request to be treated as a stream error of type H3_MESSAGE_ERROR. nghttp3 already detects every case (missing, duplicate or invalid pseudo-header fields, connection-specific fields, TE other than trailers, content-length mismatch) and reports it as a non-fatal NGHTTP3_ERR_MALFORMED_HTTP_HEADER/_MESSAGING out of nghttp3_conn_read_stream, but the module treated any negative return as fatal and closed the whole QUIC connection, ending every other request in flight on it. Translate exactly those two errors into a per-stream rejection instead: reset the request stream with the inferred H3_MESSAGE_ERROR code, stop reading it, drop it from nghttp3, and keep the connection serving. All other nghttp3 errors keep the existing connection-error path, as RFC 9114 demands for frame-layer violations. The new checks run only on the error path; the success path is unchanged except for a done-flag test that also stops rejected or already-reset streams from being dispatched to a worker. Tested by test/http3/test_020_malformed.py with a raw QPACK client: each malformed request must yield a stream reset with 0x010E and the same connection must then serve a well-formed request.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RFC 9114 4.1.2 requires a malformed request to be treated as a stream error of type H3_MESSAGE_ERROR. nghttp3 already detects every case (missing, duplicate or invalid pseudo-header fields, connection-specific fields, TE other than trailers, content-length mismatch) and reports it as a non-fatal NGHTTP3_ERR_MALFORMED_HTTP_HEADER/_MESSAGING out of nghttp3_conn_read_stream, but the module treated any negative return as fatal and closed the whole QUIC connection, ending every other request in flight on it.
Translate exactly those two errors into a per-stream rejection instead: reset the request stream with the inferred H3_MESSAGE_ERROR code, stop reading it, drop it from nghttp3, and keep the connection serving. All other nghttp3 errors keep the existing connection-error path, as RFC 9114 demands for frame-layer violations.
The new checks run only on the error path; the success path is unchanged except for a done-flag test that also stops rejected or already-reset streams from being dispatched to a worker.
Tested by test/http3/test_020_malformed.py with a raw QPACK client: each malformed request must yield a stream reset with 0x010E and the same connection must then serve a well-formed request.