You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hc.apache.org by "arturobernalg (via GitHub)" <gi...@apache.org> on 2026/02/23 09:45:25 UTC
[PR] HTTP/2: require peer SETTINGS as first frame [httpcomponents-core]
arturobernalg opened a new pull request, #636:
URL: https://github.com/apache/httpcomponents-core/pull/636
Enforce RFC 9113 connection preface rules by rejecting non-SETTINGS frames received before the peer SETTINGS once the connection handshake is active.
[RFC 9113, Section 3.4](https://www.rfc-editor.org/rfc/rfc9113.html#section-3.4): That is, the connection preface starts with the string "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n". This sequence MUST be followed by a [SETTINGS](https://www.rfc-editor.org/rfc/rfc9113.html#SETTINGS) frame ([Section 6.5](https://www.rfc-editor.org/rfc/rfc9113.html#SETTINGS)), which MAY be empty. The client sends the client connection preface as the first application data octets of a connection.
[RFC 9113, Section 6.5: ](https://www.rfc-editor.org/rfc/rfc9113.html#name-settings) Receipt of a SETTINGS frame with the ACK flag set and a length field value other than 0 MUST be treated as a [connection error](https://www.rfc-editor.org/rfc/rfc9113.html#ConnectionErrorHandler) ([Section 5.4.1](https://www.rfc-editor.org/rfc/rfc9113.html#ConnectionErrorHandler)) of type [FRAME_SIZE_ERROR](https://www.rfc-editor.org/rfc/rfc9113.html#FRAME_SIZE_ERROR). For more information, see [Section 6.5.3](https://www.rfc-editor.org/rfc/rfc9113.html#SettingsSync) ("[Settings Synchronization](https://www.rfc-editor.org/rfc/rfc9113.html#SettingsSync)").
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: [PR] HTTP/2: require peer SETTINGS as first frame [httpcomponents-core]
Posted by "ok2c (via GitHub)" <gi...@apache.org>.
ok2c commented on code in PR #636:
URL: https://github.com/apache/httpcomponents-core/pull/636#discussion_r2842692903
##########
httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/AbstractH2StreamMultiplexer.java:
##########
@@ -960,6 +965,10 @@ private void consumeFrame(final RawFrame frame) throws HttpException, IOExceptio
if (payload != null && payload.hasRemaining()) {
throw new H2ConnectionException(H2Error.FRAME_SIZE_ERROR, "Invalid SETTINGS ACK payload");
}
+ // RFC 9113, Section 3.4 / 6.5: the first peer SETTINGS cannot be ACK.
Review Comment:
@arturobernalg I would avoid references in specific RFCs or their sections in our source code. If the RFC 9113 gets superseded by a newer revision we would have to go through our code and update all these references
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: [PR] HTTP/2: require peer SETTINGS as first frame [httpcomponents-core]
Posted by "arturobernalg (via GitHub)" <gi...@apache.org>.
arturobernalg commented on code in PR #636:
URL: https://github.com/apache/httpcomponents-core/pull/636#discussion_r2845710459
##########
httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/AbstractH2StreamMultiplexer.java:
##########
@@ -960,6 +965,10 @@ private void consumeFrame(final RawFrame frame) throws HttpException, IOExceptio
if (payload != null && payload.hasRemaining()) {
throw new H2ConnectionException(H2Error.FRAME_SIZE_ERROR, "Invalid SETTINGS ACK payload");
}
+ // RFC 9113, Section 3.4 / 6.5: the first peer SETTINGS cannot be ACK.
Review Comment:
Done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: [PR] HTTP/2: require peer SETTINGS as first frame [httpcomponents-core]
Posted by "arturobernalg (via GitHub)" <gi...@apache.org>.
arturobernalg merged PR #636:
URL: https://github.com/apache/httpcomponents-core/pull/636
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org