Limit the number of incoming reserved (remote) streams

RFC 7540 does not enforce any limit on the number of incoming reserved
streams (in RFC 7540 terms, streams in reserved (remote) state).  This
only affects client side, since only server can push streams.
Malicious server can push arbitrary number of streams, and make
client's memory exhausted.  The new option,
nghttp2_set_max_reserved_remote_streams, can set the maximum number of
such incoming streams to avoid possible memory exhaustion.  If this
option is set, and pushed streams are automatically closed on
reception, without calling user provided callback, if they exceed the
given limit.  The default value is 200.  If session is configured as
server side, this option has no effect.  Server can control the number
of streams to push.

lib/includes/nghttp2/nghttp2.h

@@ -2031,6 +2031,25 @@ nghttp2_option_set_no_recv_client_magic(nghttp2_option *option, int val);
 NGHTTP2_EXTERN void nghttp2_option_set_no_http_messaging(nghttp2_option *option,
                                                          int val);
 
+/**
+ * @function
+ *
+ * RFC 7540 does not enforce any limit on the number of incoming
+ * reserved streams (in RFC 7540 terms, streams in reserved (remote)
+ * state).  This only affects client side, since only server can push
+ * streams.  Malicious server can push arbitrary number of streams,
+ * and make client's memory exhausted.  This option can set the
+ * maximum number of such incoming streams to avoid possible memory
+ * exhaustion.  If this option is set, and pushed streams are
+ * automatically closed on reception, without calling user provided
+ * callback, if they exceed the given limit.  The default value is
+ * 200.  If session is configured as server side, this option has no
+ * effect.  Server can control the number of streams to push.
+ */
+NGHTTP2_EXTERN void
+nghttp2_option_set_max_reserved_remote_streams(nghttp2_option *option,
+                                               uint32_t val);
+
 /**
  * @function
  *

lib/nghttp2_option.c

@@ -56,3 +56,9 @@ void nghttp2_option_set_no_http_messaging(nghttp2_option *option, int val) {
   option->opt_set_mask |= NGHTTP2_OPT_NO_HTTP_MESSAGING;
   option->no_http_messaging = val;
 }
+
+void nghttp2_option_set_max_reserved_remote_streams(nghttp2_option *option,
+                                                    uint32_t val) {
+  option->opt_set_mask |= NGHTTP2_OPT_MAX_RESERVED_REMOTE_STREAMS;
+  option->max_reserved_remote_streams = val;
+}

lib/nghttp2_option.h

@@ -58,7 +58,8 @@ typedef enum {
    */
   NGHTTP2_OPT_PEER_MAX_CONCURRENT_STREAMS = 1 << 1,
   NGHTTP2_OPT_NO_RECV_CLIENT_MAGIC = 1 << 2,
-  NGHTTP2_OPT_NO_HTTP_MESSAGING = 1 << 3
+  NGHTTP2_OPT_NO_HTTP_MESSAGING = 1 << 3,
+  NGHTTP2_OPT_MAX_RESERVED_REMOTE_STREAMS = 1 << 4
 } nghttp2_option_flag;
 
 /**
@@ -74,6 +75,10 @@ struct nghttp2_option {
    * NGHTTP2_OPT_PEER_MAX_CONCURRENT_STREAMS
    */
   uint32_t peer_max_concurrent_streams;
+  /**
+   * NGHTTP2_OPT_MAX_RESERVED_REMOTE_STREAMS
+   */
+  uint32_t max_reserved_remote_streams;
   /**
    * NGHTTP2_OPT_NO_AUTO_WINDOW_UPDATE
    */

lib/nghttp2_session.c

@@ -372,6 +372,9 @@ static int session_new(nghttp2_session **session_ptr,
   init_settings(&(*session_ptr)->remote_settings);
   init_settings(&(*session_ptr)->local_settings);
 
+  (*session_ptr)->max_incoming_reserved_streams =
+      NGHTTP2_MAX_INCOMING_RESERVED_STREAMS;
+
   if (option) {
     if ((option->opt_set_mask & NGHTTP2_OPT_NO_AUTO_WINDOW_UPDATE) &&
         option->no_auto_window_update) {
@@ -385,6 +388,12 @@ static int session_new(nghttp2_session **session_ptr,
           option->peer_max_concurrent_streams;
     }
 
+    if (option->opt_set_mask & NGHTTP2_OPT_MAX_RESERVED_REMOTE_STREAMS) {
+
+      (*session_ptr)->max_incoming_reserved_streams =
+          option->max_reserved_remote_streams;
+    }
+
     if ((option->opt_set_mask & NGHTTP2_OPT_NO_RECV_CLIENT_MAGIC) &&
         option->no_recv_client_magic) {
 
@@ -910,11 +919,12 @@ nghttp2_stream *nghttp2_session_open_stream(nghttp2_session *session,
   switch (initial_state) {
   case NGHTTP2_STREAM_RESERVED:
     if (nghttp2_session_is_my_stream_id(session, stream_id)) {
-      /* half closed (remote) */
+      /* reserved (local) */
       nghttp2_stream_shutdown(stream, NGHTTP2_SHUT_RD);
     } else {
-      /* half closed (local) */
+      /* reserved (remote) */
       nghttp2_stream_shutdown(stream, NGHTTP2_SHUT_WR);
+      ++session->num_incoming_reserved_streams;
     }
     /* Reserved stream does not count in the concurrent streams
        limit. That is one of the DOS vector. */
@@ -1017,7 +1027,11 @@ int nghttp2_session_close_stream(nghttp2_session *session, int32_t stream_id,
 
   /* pushed streams which is not opened yet is not counted toward max
      concurrent limits */
-  if ((stream->flags & NGHTTP2_STREAM_FLAG_PUSH) == 0) {
+  if ((stream->flags & NGHTTP2_STREAM_FLAG_PUSH)) {
+    if (!nghttp2_session_is_my_stream_id(session, stream_id)) {
+      --session->num_incoming_reserved_streams;
+    }
+  } else {
     if (nghttp2_session_is_my_stream_id(session, stream_id)) {
       --session->num_outgoing_streams;
     } else {
@@ -3458,6 +3472,9 @@ int nghttp2_session_on_push_response_headers_received(nghttp2_session *session,
   }
 
   nghttp2_stream_promise_fulfilled(stream);
+  if (!nghttp2_session_is_my_stream_id(session, stream->stream_id)) {
+    --session->num_incoming_reserved_streams;
+  }
   ++session->num_incoming_streams;
   rv = session_call_on_begin_headers(session, frame);
   if (rv != 0) {
@@ -4057,7 +4074,9 @@ int nghttp2_session_on_push_promise_received(nghttp2_session *session,
   session->last_recv_stream_id = frame->push_promise.promised_stream_id;
   stream = nghttp2_session_get_stream(session, frame->hd.stream_id);
   if (!stream || stream->state == NGHTTP2_STREAM_CLOSING ||
-      !session->pending_enable_push) {
+      !session->pending_enable_push ||
+      session->num_incoming_reserved_streams >=
+          session->max_incoming_reserved_streams) {
     if (!stream) {
       if (session_detect_idle_stream(session, frame->hd.stream_id)) {
         return session_inflate_handle_invalid_connection(

lib/nghttp2_session.h

@@ -66,6 +66,9 @@ typedef struct {
    nghttp2_session_recv(). */
 #define NGHTTP2_INBOUND_BUFFER_LENGTH 16384
 
+/* The default maximum number of incoming reserved streams */
+#define NGHTTP2_MAX_INCOMING_RESERVED_STREAMS 200
+
 /* Internal state when receiving incoming frame */
 typedef enum {
   /* Receiving frame header */
@@ -194,6 +197,19 @@ struct nghttp2_session {
   /* The number of incoming streams. This will be capped by
      local_settings.max_concurrent_streams. */
   size_t num_incoming_streams;
+  /* The number of incoming reserved streams.  This is the number of
+     streams in reserved (remote) state.  RFC 7540 does not limit this
+     number.  nghttp2 offers
+     nghttp2_option_set_max_reserved_remote_streams() to achieve this.
+     If it is used, num_incoming_streams is capped by
+     max_incoming_reserved_streams.  Client application should
+     consider to set this because without that server can send
+     arbitrary number of PUSH_PROMISE, and exhaust client's memory. */
+  size_t num_incoming_reserved_streams;
+  /* The maximum number of incoming reserved streams (reserved
+     (remote) state).  RST_STREAM will be sent for the pushed stream
+     which exceeds this limit. */
+  size_t max_incoming_reserved_streams;
   /* The number of closed streams still kept in |streams| hash.  The
      closed streams can be accessed through single linked list
      |closed_stream_head|.  The current implementation only keeps

tests/nghttp2_session_test.c

@@ -2065,9 +2065,11 @@ void test_nghttp2_session_on_push_response_headers_received(void) {
   user_data.begin_headers_cb_called = 0;
   user_data.invalid_frame_recv_cb_called = 0;
 
+  CU_ASSERT(1 == session->num_incoming_reserved_streams);
   CU_ASSERT(0 == nghttp2_session_on_push_response_headers_received(
                      session, &frame, stream));
   CU_ASSERT(1 == user_data.begin_headers_cb_called);
+  CU_ASSERT(0 == session->num_incoming_reserved_streams);
   CU_ASSERT(NGHTTP2_STREAM_OPENED == stream->state);
   CU_ASSERT(1 == session->num_incoming_streams);
   CU_ASSERT(0 == (stream->flags & NGHTTP2_STREAM_FLAG_PUSH));
@@ -2086,6 +2088,7 @@ void test_nghttp2_session_on_push_response_headers_received(void) {
   CU_ASSERT(NGHTTP2_RST_STREAM == item->frame.hd.type);
   CU_ASSERT(NGHTTP2_REFUSED_STREAM == item->frame.rst_stream.error_code);
   CU_ASSERT(1 == session->num_incoming_streams);
+  CU_ASSERT(1 == session->num_incoming_reserved_streams);
 
   CU_ASSERT(0 == nghttp2_session_send(session));
   CU_ASSERT(1 == session->num_incoming_streams);
@@ -2106,6 +2109,7 @@ void test_nghttp2_session_on_push_response_headers_received(void) {
   CU_ASSERT(NGHTTP2_GOAWAY == item->frame.hd.type);
   CU_ASSERT(NGHTTP2_PROTOCOL_ERROR == item->frame.goaway.error_code);
   CU_ASSERT(1 == session->num_incoming_streams);
+  CU_ASSERT(1 == session->num_incoming_reserved_streams);
 
   nghttp2_frame_headers_free(&frame.headers, mem);
   nghttp2_session_del(session);
@@ -2401,6 +2405,7 @@ void test_nghttp2_session_on_push_promise_received(void) {
   CU_ASSERT(0 == nghttp2_session_on_push_promise_received(session, &frame));
 
   CU_ASSERT(1 == user_data.begin_headers_cb_called);
+  CU_ASSERT(1 == session->num_incoming_reserved_streams);
   promised_stream = nghttp2_session_get_stream(session, 2);
   CU_ASSERT(NGHTTP2_STREAM_RESERVED == promised_stream->state);
   CU_ASSERT(2 == session->last_recv_stream_id);
@@ -2416,6 +2421,7 @@ void test_nghttp2_session_on_push_promise_received(void) {
 
   CU_ASSERT(0 == user_data.begin_headers_cb_called);
   CU_ASSERT(1 == user_data.invalid_frame_recv_cb_called);
+  CU_ASSERT(1 == session->num_incoming_reserved_streams);
   CU_ASSERT(NULL == nghttp2_session_get_stream(session, 4));
   item = nghttp2_session_get_next_ob_item(session);
   CU_ASSERT(NGHTTP2_RST_STREAM == item->frame.hd.type);
@@ -2435,6 +2441,7 @@ void test_nghttp2_session_on_push_promise_received(void) {
             nghttp2_session_on_push_promise_received(session, &frame));
 
   CU_ASSERT(0 == user_data.begin_headers_cb_called);
+  CU_ASSERT(1 == session->num_incoming_reserved_streams);
   CU_ASSERT(NULL == nghttp2_session_get_stream(session, 6));
   item = nghttp2_session_get_next_ob_item(session);
   CU_ASSERT(NGHTTP2_RST_STREAM == item->frame.hd.type);
@@ -2452,6 +2459,7 @@ void test_nghttp2_session_on_push_promise_received(void) {
             nghttp2_session_on_push_promise_received(session, &frame));
 
   CU_ASSERT(0 == user_data.begin_headers_cb_called);
+  CU_ASSERT(1 == session->num_incoming_reserved_streams);
   CU_ASSERT(NULL == nghttp2_session_get_stream(session, 8));
   item = nghttp2_session_get_next_ob_item(session);
   CU_ASSERT(NGHTTP2_GOAWAY == item->frame.hd.type);
@@ -2468,7 +2476,16 @@ void test_nghttp2_session_on_push_promise_received(void) {
                                        NGHTTP2_STREAM_OPENING, NULL);
 
   /* Same ID twice */
-  stream->state = NGHTTP2_STREAM_OPENING;
+  frame.hd.stream_id = 1;
+  frame.push_promise.promised_stream_id = 2;
+
+  user_data.begin_headers_cb_called = 0;
+  user_data.invalid_frame_recv_cb_called = 0;
+  CU_ASSERT(0 == nghttp2_session_on_push_promise_received(session, &frame));
+
+  CU_ASSERT(1 == user_data.begin_headers_cb_called);
+  CU_ASSERT(1 == session->num_incoming_reserved_streams);
+  CU_ASSERT(NULL != nghttp2_session_get_stream(session, 2));
 
   user_data.begin_headers_cb_called = 0;
   user_data.invalid_frame_recv_cb_called = 0;
@@ -2476,6 +2493,7 @@ void test_nghttp2_session_on_push_promise_received(void) {
             nghttp2_session_on_push_promise_received(session, &frame));
 
   CU_ASSERT(0 == user_data.begin_headers_cb_called);
+  CU_ASSERT(1 == session->num_incoming_reserved_streams);
   CU_ASSERT(NULL == nghttp2_session_get_stream(session, 8));
   item = nghttp2_session_get_next_ob_item(session);
   CU_ASSERT(NGHTTP2_GOAWAY == item->frame.hd.type);
@@ -2491,6 +2509,7 @@ void test_nghttp2_session_on_push_promise_received(void) {
             nghttp2_session_on_push_promise_received(session, &frame));
 
   CU_ASSERT(0 == user_data.begin_headers_cb_called);
+  CU_ASSERT(1 == session->num_incoming_reserved_streams);
   CU_ASSERT(NULL == nghttp2_session_get_stream(session, 10));
   CU_ASSERT(NULL == nghttp2_session_get_next_ob_item(session));
 
@@ -2512,6 +2531,7 @@ void test_nghttp2_session_on_push_promise_received(void) {
 
   CU_ASSERT(0 == user_data.begin_headers_cb_called);
   CU_ASSERT(1 == user_data.invalid_frame_recv_cb_called);
+  CU_ASSERT(1 == session->num_incoming_reserved_streams);
 
   nghttp2_frame_push_promise_free(&frame.push_promise, mem);
   nghttp2_session_del(session);
@@ -2534,6 +2554,7 @@ void test_nghttp2_session_on_push_promise_received(void) {
 
   CU_ASSERT(0 == user_data.begin_headers_cb_called);
   CU_ASSERT(1 == user_data.invalid_frame_recv_cb_called);
+  CU_ASSERT(0 == session->num_incoming_reserved_streams);
 
   nghttp2_frame_push_promise_free(&frame.push_promise, mem);
   nghttp2_session_del(session);
@@ -2572,6 +2593,35 @@ void test_nghttp2_session_on_push_promise_received(void) {
   CU_ASSERT(NGHTTP2_ERR_IGN_HEADER_BLOCK ==
             nghttp2_session_on_push_promise_received(session, &frame));
 
+  CU_ASSERT(0 == session->num_incoming_reserved_streams);
+
+  nghttp2_frame_push_promise_free(&frame.push_promise, mem);
+  nghttp2_session_del(session);
+
+  /* Check max_incoming_reserved_streams */
+  nghttp2_session_client_new(&session, &callbacks, &user_data);
+  session->max_incoming_reserved_streams = 1;
+
+  nghttp2_session_open_stream(session, 1, NGHTTP2_STREAM_FLAG_NONE,
+                              &pri_spec_default, NGHTTP2_STREAM_OPENING, NULL);
+  nghttp2_session_open_stream(session, 2, NGHTTP2_STREAM_FLAG_NONE,
+                              &pri_spec_default, NGHTTP2_STREAM_RESERVED, NULL);
+
+  CU_ASSERT(1 == session->num_incoming_reserved_streams);
+
+  nghttp2_frame_push_promise_init(&frame.push_promise, NGHTTP2_FLAG_END_HEADERS,
+                                  1, 4, NULL, 0);
+
+  CU_ASSERT(NGHTTP2_ERR_IGN_HEADER_BLOCK ==
+            nghttp2_session_on_push_promise_received(session, &frame));
+
+  CU_ASSERT(1 == session->num_incoming_reserved_streams);
+
+  item = nghttp2_session_get_next_ob_item(session);
+
+  CU_ASSERT(NGHTTP2_RST_STREAM == item->frame.hd.type);
+  CU_ASSERT(NGHTTP2_REFUSED_STREAM == item->frame.rst_stream.error_code);
+
   nghttp2_frame_push_promise_free(&frame.push_promise, mem);
   nghttp2_session_del(session);
 }
@@ -5398,6 +5448,13 @@ void test_nghttp2_session_set_option(void) {
   CU_ASSERT(100 == session->remote_settings.max_concurrent_streams);
   nghttp2_session_del(session);
 
+  nghttp2_option_set_max_reserved_remote_streams(option, 99);
+
+  nghttp2_session_client_new2(&session, &callbacks, NULL, option);
+
+  CU_ASSERT(99 == session->max_incoming_reserved_streams);
+  nghttp2_session_del(session);
+
   nghttp2_option_del(option);
 }