k2safe/go-omni
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: harden experimental HTTP2 request limits

Browse Source
This commit is contained in:
k2safe
2026-09-22 22:38:37 +08:00
parent 1a20ab53ac
commit 1487a96f67
4 changed files with 206 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
transport/http2/server.go
View File

@@ -23,6 +23,7 @@ import (
const (
defaultShutdownTimeout = 10 * time.Second
defaultTLSHandshake = 10 * time.Second
defaultMaxBodyBytes = 8 << 20
http2ALPNProtocol = "h2"
)
@@ -34,6 +35,7 @@ type Server struct {
MaxConnections int
MaxConcurrentRequests int
MaxConcurrentStreams uint32
MaxBodyBytes int64
IdleTimeout time.Duration
TLSHandshakeTimeout time.Duration
ShutdownTimeout time.Duration
@@ -71,7 +73,11 @@ type Stats struct {
// New creates an HTTP/2 transport with the supplied handler. The handler may
// also be supplied by App.RunWith through the Runner interface.
func New(handler http.Handler) *Server {
return &Server{handler: handler, conns: make(map[net.Conn]struct{})}
return &Server{
handler: handler,
conns: make(map[net.Conn]struct{}),
MaxBodyBytes: defaultMaxBodyBytes,
}
}
// Stats returns a lock-free snapshot suitable for a metrics handler.
@@ -203,7 +209,18 @@ func (s *Server) Serve(ctx context.Context, listener net.Listener) error {
}
s.mu.Unlock()
gate := &requestGate{server: s, next: s.handler, slots: s.requestSlots}
requestHandler := http.Handler(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
if s.MaxBodyBytes > 0 {
if request.ContentLength > s.MaxBodyBytes {
_ = request.Body.Close()
http.Error(writer, "request body too large\n", http.StatusRequestEntityTooLarge)
return
}
request.Body = http.MaxBytesReader(writer, request.Body, s.MaxBodyBytes)
}
s.handler.ServeHTTP(writer, request)
}))
gate := &requestGate{server: s, next: requestHandler, slots: s.requestSlots}
protocolServer := &xhttp2.Server{
MaxConcurrentStreams: s.MaxConcurrentStreams,
IdleTimeout: s.IdleTimeout,

181
transport/http2/server_test.go
View File

@@ -1,6 +1,7 @@
package http2
import (
"bytes"
"context"
"crypto/rand"
"crypto/rsa"
@@ -8,10 +9,13 @@ import (
"crypto/x509"
"crypto/x509/pkix"
"errors"
"fmt"
"io"
"math/big"
"net"
"net/http"
"sync"
"sync/atomic"
"testing"
"time"
@@ -122,6 +126,183 @@ func TestServerEnforcesGlobalRequestLimitAndRecovers(t *testing.T) {
}
}
func TestServerRejectsBodyAboveLimitAndRecovers(t *testing.T) {
server := New(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
body, err := io.ReadAll(request.Body)
if err != nil {
http.Error(writer, err.Error(), http.StatusRequestEntityTooLarge)
return
}
_, _ = writer.Write(body)
}))
server.MaxBodyBytes = 4
address, stop := startServer(t, server)
defer stop()
transport := &xhttp2.Transport{
AllowHTTP: true,
DialTLSContext: func(ctx context.Context, network, address string, _ *tls.Config) (net.Conn, error) {
return (&net.Dialer{}).DialContext(ctx, network, address)
},
}
client := &http.Client{Transport: transport, Timeout: 3 * time.Second}
defer transport.CloseIdleConnections()
request, err := http.NewRequest(http.MethodPost, "http://"+address+"/too-large", bytes.NewReader([]byte("12345")))
if err != nil {
t.Fatal(err)
}
response, err := client.Do(request)
if err != nil {
t.Fatal(err)
}
response.Body.Close()
if response.StatusCode != http.StatusRequestEntityTooLarge {
t.Fatalf("expected 413 for oversized body, got %d", response.StatusCode)
}
request, err = http.NewRequest(http.MethodPost, "http://"+address+"/ok", bytes.NewReader([]byte("1234")))
if err != nil {
t.Fatal(err)
}
response, err = client.Do(request)
if err != nil {
t.Fatal(err)
}
body, readErr := io.ReadAll(response.Body)
response.Body.Close()
if readErr != nil || response.StatusCode != http.StatusOK || string(body) != "1234" {
t.Fatalf("body limit did not recover: status=%d body=%q err=%v", response.StatusCode, body, readErr)
}
}
func TestServerMultiplexes128Streams(t *testing.T) {
started := make(chan struct{}, 128)
release := make(chan struct{})
var active, maximum atomic.Int32
server := New(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
current := active.Add(1)
for {
seen := maximum.Load()
if current <= seen || maximum.CompareAndSwap(seen, current) {
break
}
}
started <- struct{}{}
<-release
active.Add(-1)
_, _ = io.WriteString(writer, request.URL.Path)
}))
server.MaxConcurrentStreams = 128
address, stop := startServer(t, server)
defer stop()
transport := &xhttp2.Transport{
AllowHTTP: true,
DialTLSContext: func(ctx context.Context, network, address string, _ *tls.Config) (net.Conn, error) {
return (&net.Dialer{}).DialContext(ctx, network, address)
},
}
client := &http.Client{Transport: transport, Timeout: 5 * time.Second}
defer transport.CloseIdleConnections()
type multiplexedResponse struct {
response *http.Response
expected string
}
responses := make(chan multiplexedResponse, 128)
errorsCh := make(chan error, 128)
for i := 0; i < 128; i++ {
go func(i int) {
response, err := client.Get(fmt.Sprintf("http://%s/stream-%d", address, i))
if err != nil {
errorsCh <- err
return
}
responses <- multiplexedResponse{response: response, expected: fmt.Sprintf("/stream-%d", i)}
}(i)
}
for i := 0; i < 128; i++ {
select {
case <-started:
case err := <-errorsCh:
close(release)
t.Fatal(err)
case <-time.After(5 * time.Second):
close(release)
t.Fatal("HTTP/2 streams did not reach the handler")
}
}
if got := maximum.Load(); got < 128 {
close(release)
t.Fatalf("expected 128 concurrent streams, got %d", got)
}
if stats := server.Stats(); stats.ActiveConnections != 1 {
close(release)
t.Fatalf("expected one multiplexed connection, got %+v", stats)
}
close(release)
for i := 0; i < 128; i++ {
select {
case result := <-responses:
body, err := io.ReadAll(result.response.Body)
result.response.Body.Close()
if err != nil || result.response.StatusCode != http.StatusOK || string(body) != result.expected {
t.Fatalf("unexpected multiplexed response: status=%d body=%q expected=%q err=%v", result.response.StatusCode, body, result.expected, err)
}
case err := <-errorsCh:
t.Fatal(err)
case <-time.After(5 * time.Second):
t.Fatal("HTTP/2 streams did not finish")
}
}
}
func TestServerStreamsLargeBodyWithFlowControl(t *testing.T) {
server := New(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
var total int64
buffer := make([]byte, 16<<10)
for {
n, err := request.Body.Read(buffer)
total += int64(n)
if n > 0 {
time.Sleep(time.Millisecond)
}
if err == io.EOF {
break
}
if err != nil {
http.Error(writer, err.Error(), http.StatusBadRequest)
return
}
}
_, _ = fmt.Fprintf(writer, "%d", total)
}))
server.MaxBodyBytes = 4 << 20
address, stop := startServer(t, server)
defer stop()
transport := &xhttp2.Transport{
AllowHTTP: true,
DialTLSContext: func(ctx context.Context, network, address string, _ *tls.Config) (net.Conn, error) {
return (&net.Dialer{}).DialContext(ctx, network, address)
},
}
client := &http.Client{Transport: transport, Timeout: 10 * time.Second}
defer transport.CloseIdleConnections()
payload := bytes.Repeat([]byte("x"), 2<<20)
request, err := http.NewRequest(http.MethodPost, "http://"+address+"/large", bytes.NewReader(payload))
if err != nil {
t.Fatal(err)
}
response, err := client.Do(request)
if err != nil {
t.Fatal(err)
}
body, readErr := io.ReadAll(response.Body)
response.Body.Close()
if readErr != nil || response.StatusCode != http.StatusOK || string(body) != "2097152" {
t.Fatalf("large body flow-control result: status=%d body=%q err=%v", response.StatusCode, body, readErr)
}
}
func TestServerTLSUsesH2ALPN(t *testing.T) {
certificate, roots := testCertificate(t)
server := New(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {