RFC 9113: limit the number of pending control frames

httpcore5-h2/src/main/java/org/apache/hc/core5/http2/config/H2Config.java

@@ -51,10 +51,11 @@ public class H2Config {
     private final int maxHeaderListSize;
     private final boolean compressionEnabled;
     private final int maxContinuations;
+    private final int maxControlFrames;
 
     H2Config(final int headerTableSize, final boolean pushEnabled, final int maxConcurrentStreams,
              final int initialWindowSize, final int maxFrameSize, final int maxHeaderListSize,
-             final boolean compressionEnabled, final int maxContinuations) {
+             final boolean compressionEnabled, final int maxContinuations, final int maxControlFrames) {
         super();
         this.headerTableSize = headerTableSize;
         this.pushEnabled = pushEnabled;
@@ -64,6 +65,7 @@ public class H2Config {
         this.maxHeaderListSize = maxHeaderListSize;
         this.compressionEnabled = compressionEnabled;
         this.maxContinuations = maxContinuations;
+        this.maxControlFrames = maxControlFrames;
     }
 
     public int getHeaderTableSize() {
@@ -98,6 +100,19 @@ public int getMaxContinuations() {
         return maxContinuations;
     }
 
+    /**
+     * Returns the maximum number of control frames (PING and SETTINGS acknowledgements, WINDOW_UPDATE
+     * and RST_STREAM frames generated in response to peer frames) that may be pending output before
+     * the connection is closed. A GOAWAY carrying {@code ENHANCE_YOUR_CALM} is sent when the output
+     * still permits it; a peer that stops reading forces an immediate close instead. A value of zero
+     * disables the limit.
+     *
+     * @since 5.5
+     */
+    public int getMaxControlFrames() {
+        return maxControlFrames;
+    }
+
     @Override
     public String toString() {
         final StringBuilder builder = new StringBuilder();
@@ -109,6 +124,7 @@ public String toString() {
                 .append(", maxHeaderListSize=").append(this.maxHeaderListSize)
                 .append(", compressionEnabled=").append(this.compressionEnabled)
                 .append(", maxContinuations=").append(this.maxContinuations)
+                .append(", maxControlFrames=").append(this.maxControlFrames)
                 .append("]");
         return builder.toString();
     }
@@ -122,6 +138,7 @@ public static H2Config.Builder custom() {
     private static final int INIT_MAX_FRAME_SIZE = FrameConsts.MIN_FRAME_SIZE;
     private static final int INIT_WINDOW_SIZE = 65535;
     private static final int INIT_CONCURRENT_STREAM = 250;
+    private static final int INIT_MAX_CONTROL_FRAMES = 1000;
 
     public static H2Config.Builder initial() {
         return new Builder()
@@ -142,7 +159,9 @@ public static H2Config.Builder copy(final H2Config config) {
                 .setInitialWindowSize(config.getInitialWindowSize())
                 .setMaxFrameSize(config.getMaxFrameSize())
                 .setMaxHeaderListSize(config.getMaxHeaderListSize())
-                .setCompressionEnabled(config.isCompressionEnabled());
+                .setCompressionEnabled(config.isCompressionEnabled())
+                .setMaxContinuations(config.getMaxContinuations())
+                .setMaxControlFrames(config.getMaxControlFrames());
     }
 
     public static class Builder {
@@ -155,6 +174,7 @@ public static class Builder {
         private int maxHeaderListSize;
         private boolean compressionEnabled;
         private int maxContinuations;
+        private int maxControlFrames;
 
         Builder() {
             this.headerTableSize = INIT_HEADER_TABLE_SIZE * 2;
@@ -165,6 +185,7 @@ public static class Builder {
             this.maxHeaderListSize = FrameConsts.MAX_FRAME_SIZE;
             this.compressionEnabled = true;
             this.maxContinuations = 100;
+            this.maxControlFrames = INIT_MAX_CONTROL_FRAMES;
         }
 
         public Builder setHeaderTableSize(final int headerTableSize) {
@@ -215,6 +236,21 @@ public Builder setMaxContinuations(final int maxContinuations) {
             return this;
         }
 
+        /**
+         * Sets the maximum number of control frames (PING and SETTINGS acknowledgements, WINDOW_UPDATE
+         * and RST_STREAM frames generated in response to peer frames) that may be pending output before
+         * the connection is closed. A GOAWAY carrying {@code ENHANCE_YOUR_CALM} is sent when the output
+         * still permits it; a peer that stops reading forces an immediate close instead. A value of zero
+         * disables the limit.
+         *
+         * @since 5.5
+         */
+        public Builder setMaxControlFrames(final int maxControlFrames) {
+            Args.notNegative(maxControlFrames, "Max control frames");
+            this.maxControlFrames = maxControlFrames;
+            return this;
+        }
+
         public H2Config build() {
             return new H2Config(
                     headerTableSize,
@@ -224,7 +260,8 @@ public H2Config build() {
                     maxFrameSize,
                     maxHeaderListSize,
                     compressionEnabled,
-                    maxContinuations);
+                    maxContinuations,
+                    maxControlFrames);
         }
 
     }

httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/AbstractH2StreamMultiplexer.java

@@ -143,6 +143,10 @@ enum SettingsHandshake { READY, TRANSMITTED, ACKED }
     private EndpointDetails endpointDetails;
     private boolean goAwayReceived;
 
+    // Number of control-frame responses (PING/SETTINGS acks, WINDOW_UPDATE, RST_STREAM) currently
+    // held in the output queue awaiting a flush. Guarded by the IO session lock.
+    private int queuedControlFrames;
+
     private volatile boolean peerNoRfc7540Priorities;
 
 
@@ -307,11 +311,27 @@ private void commitFrameInternal(final RawFrame frame) throws IOException {
             }
             outputBuffer.write(frame, ioSession);
         } else {
+            if (isControlFrame(frame)) {
+                final int maxControlFrames = localConfig.getMaxControlFrames();
+                if (maxControlFrames > 0 && queuedControlFrames >= maxControlFrames) {
+                    throw new H2ConnectionException(H2Error.ENHANCE_YOUR_CALM,
+                            "Maximum number of outstanding control frames exceeded");
+                }
+                queuedControlFrames++;
+            }
             outputQueue.addLast(frame);
         }
         ioSession.setEvent(SelectionKey.OP_WRITE);
     }
 
+    private static boolean isControlFrame(final RawFrame frame) {
+        final int type = frame.getType();
+        return type == FrameType.SETTINGS.getValue()
+                || type == FrameType.PING.getValue()
+                || type == FrameType.WINDOW_UPDATE.getValue()
+                || type == FrameType.RST_STREAM.getValue();
+    }
+
     private void commitFrame(final RawFrame frame) throws IOException {
         Args.notNull(frame, "Frame");
         ioSession.getLock().lock();
@@ -509,6 +529,9 @@ public final void onOutput() throws HttpException, IOException {
             while (outputBuffer.isEmpty()) {
                 final RawFrame frame = outputQueue.poll();
                 if (frame != null) {
+                    if (isControlFrame(frame)) {
+                        queuedControlFrames--;
+                    }
                     if (streamListener != null) {
                         streamListener.onFrameOutput(this, frame.getStreamId(), frame);
                     }

httpcore5-h2/src/test/java/org/apache/hc/core5/http2/config/TestH2Config.java

@@ -0,0 +1,62 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package org.apache.hc.core5.http2.config;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+class TestH2Config {
+
+    @Test
+    void testDefaultMaxControlFrames() {
+        Assertions.assertEquals(1000, H2Config.DEFAULT.getMaxControlFrames());
+    }
+
+    @Test
+    void testMaxControlFramesIsConfigurable() {
+        final H2Config config = H2Config.custom().setMaxControlFrames(0).build();
+        Assertions.assertEquals(0, config.getMaxControlFrames());
+    }
+
+    @Test
+    void testMaxControlFramesRejectsNegative() {
+        Assertions.assertThrows(IllegalArgumentException.class,
+                () -> H2Config.custom().setMaxControlFrames(-1));
+    }
+
+    @Test
+    void testCopyPreservesMaxControlFramesAndMaxContinuations() {
+        final H2Config original = H2Config.custom()
+                .setMaxControlFrames(42)
+                .setMaxContinuations(7)
+                .build();
+        final H2Config copy = H2Config.copy(original).build();
+        Assertions.assertEquals(42, copy.getMaxControlFrames());
+        Assertions.assertEquals(7, copy.getMaxContinuations());
+    }
+}