hyperium / h2

HTTP 2.0 client & server implementation for Rust.
MIT License
1.34k stars 265 forks source link

fix: limit number of CONTINUATION frames allowed #758

Closed seanmonstar closed 3 months ago

seanmonstar commented 3 months ago

Calculate the amount of allowed CONTINUATION frames based on other settings.

max_header_list_size / max_frame_size

That is about how many CONTINUATION frames would be needed to send headers up to the max allowed size. We then multiply by that by a small amount, to allow for implementations that don't perfectly pack into the minimum frames needed.

In practice, much more than that would be a very inefficient peer, or a peer trying to waste resources.

See https://seanmonstar.com/blog/hyper-http2-continuation-flood/ for more info.