Limit the number of Continuation frames per HTTP2 Headers by normanmaurer · Pull Request #13969 · netty/netty

normanmaurer · 2024-04-11T12:24:51Z

Motivation:

We should limit the number of continuation frames that the remote peer is allowed to sent per headers.

Modifications:

Limit the number of continuation frames by default to 16 and allow the user to change this.
Add unit test

Result:

Do some more validations to guard against resource usage

ejona86 · 2024-04-11T14:49:53Z

Since the default is getting set to 16, this looks like it would break existing users that allow MAX_HEADER_LIST_SIZE > 256 KiB. I'm also not wild about a config option like this which needs a reasonable amount of understanding of how other settings work together.

Could we instead base this off of MAX_HEADER_LIST_SIZE? Or only count CONTINUATIONS that are less than half of 16 KiB (which seems better than half of MAX_FRAME_SIZE), and only allow 1ish of such CONTINUATIONS? Or more simply "reject a CONTINUATION with END_HEADERS=0 if it is less than 8 KiB." Even if we have configuration for these, virtually nobody would need to actually use the setting.

bryce-anderson · 2024-04-11T15:09:02Z

The implementation looks good but I agree with Eric about his concern regarding a fix number of frames. I do like his solution of rejecting < 8KiB non-terminal continuation frames. The exact size of rejecting could be the tuning parameter where 0 is 'not checked'.

chrisvest

One thing but otherwise looks good.

codec-http2/src/test/java/io/netty/handler/codec/http2/DefaultHttp2FrameReaderTest.java

...-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java

codec-http2/src/main/java/io/netty/handler/codec/http2/DefaultHttp2FrameReader.java

...-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java

codec-http2/src/main/java/io/netty/handler/codec/http2/DefaultHttp2FrameReader.java

...-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java

ejona86

I agree with the need for style/docs mentioning "small." But the approach LGTM

Co-authored-by: Bryce Anderson <bl_anderson@apple.com>

normanmaurer · 2026-03-23T10:03:53Z

@bryce-anderson all addressed... PTAL

bryce-anderson

lgtm other than defining what small means.

...-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java

chrisvest

Generally looks good. Spotted one style issue. I'd also like a definition for "small" though I don't fully understand Bryce's proposed phrasing.

codec-http2/src/main/java/io/netty/handler/codec/http2/Http2CodecUtil.java

...-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java

bryce-anderson · 2026-03-23T17:14:36Z

I'd also like a definition for "small" though I don't fully understand Bryce's proposed phrasing.

Indeed, I tried to clean it up a bit more. Don't feel compelled to take my suggestions as is but users should know that small means < 8KiB.

Co-authored-by: Bryce Anderson <bl_anderson@apple.com> Co-authored-by: Chris Vest <mr.chrisvest@gmail.com>

Motivation: We should limit the number of continuation frames that the remote peer is allowed to sent per headers. Modifications: - Limit the number of continuation frames by default to 16 and allow the user to change this. - Add unit test Result: Do some more validations to guard against resource usage --------- Co-authored-by: Bryce Anderson <bl_anderson@apple.com> Co-authored-by: Chris Vest <mr.chrisvest@gmail.com> (cherry picked from commit 9f47a7b)

netty-project-bot · 2026-03-24T12:40:15Z

Auto-port PR for 5.0: #16535

netty-project-bot · 2026-03-24T12:40:16Z

Auto-port PR for 4.2: #16536

…ers (#16536) Auto-port of #13969 to 4.2 Cherry-picked commit: 9f47a7b --- Motivation: We should limit the number of continuation frames that the remote peer is allowed to sent per headers. Modifications: - Limit the number of continuation frames by default to 16 and allow the user to change this. - Add unit test Result: Do some more validations to guard against resource usage Co-authored-by: Norman Maurer <norman_maurer@apple.com> Co-authored-by: Bryce Anderson <bl_anderson@apple.com> Co-authored-by: Chris Vest <mr.chrisvest@gmail.com>

…ers (#16535) Auto-port of #13969 to 5.0 Cherry-picked commit: 9f47a7b --- Motivation: We should limit the number of continuation frames that the remote peer is allowed to sent per headers. Modifications: - Limit the number of continuation frames by default to 16 and allow the user to change this. - Add unit test Result: Do some more validations to guard against resource usage Co-authored-by: Norman Maurer <norman_maurer@apple.com> Co-authored-by: Bryce Anderson <bl_anderson@apple.com> Co-authored-by: Chris Vest <mr.chrisvest@gmail.com>

normanmaurer requested review from bryce-anderson, chrisvest and idelpivnitskiy April 11, 2024 12:24

normanmaurer added this to the 4.1.109.Final milestone Apr 11, 2024

normanmaurer requested a review from ejona86 April 11, 2024 12:41

idelpivnitskiy approved these changes Apr 11, 2024

View reviewed changes

normanmaurer modified the milestones: 4.1.109.Final, 4.1.110.Final Apr 15, 2024

normanmaurer modified the milestones: 4.1.110.Final, 4.1.111.Final May 22, 2024

normanmaurer modified the milestones: 4.1.111.Final, 4.1.112.Final Jun 11, 2024

normanmaurer modified the milestones: 4.1.112.Final, 4.1.113.Final Jul 19, 2024

normanmaurer modified the milestones: 4.1.113.Final, 4.1.114.Final Sep 3, 2024

normanmaurer modified the milestones: 4.1.114.Final, 4.1.115.Final Oct 1, 2024

normanmaurer modified the milestones: 4.1.115.Final, 4.1.116.Final Nov 12, 2024

normanmaurer modified the milestones: 4.1.116.Final, 4.1.117.Final Dec 17, 2024

normanmaurer modified the milestones: 4.1.117.Final, 4.1.118.Final Jan 14, 2025

normanmaurer modified the milestones: 4.1.118.Final, 4.1.119.Final Feb 13, 2025

normanmaurer modified the milestones: 4.1.119.Final, 4.1.120.Final Feb 26, 2025

chrisvest approved these changes Mar 20, 2026

View reviewed changes

codec-http2/src/test/java/io/netty/handler/codec/http2/DefaultHttp2FrameReaderTest.java Show resolved Hide resolved

add test

33a12d6

bryce-anderson reviewed Mar 20, 2026

View reviewed changes

...-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java Outdated Show resolved Hide resolved

chrisvest approved these changes Mar 20, 2026

View reviewed changes

ejona86 approved these changes Mar 20, 2026

View reviewed changes

normanmaurer and others added 3 commits March 23, 2026 10:44

Apply suggestions from code review

c79c92e

Co-authored-by: Bryce Anderson <bl_anderson@apple.com>

Fix compile error

a90ee87

Address comments

5aeaf4f

normanmaurer requested a review from bryce-anderson March 23, 2026 10:03

normanmaurer added needs-cherry-pick-4.2 This PR should be cherry-picked to 4.2 once merged. needs-cherry-pick-5.0 This PR should be cherry-picked to 5.0 once merged. labels Mar 23, 2026

bryce-anderson approved these changes Mar 23, 2026

View reviewed changes

...-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java Outdated Show resolved Hide resolved

...-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java Outdated Show resolved Hide resolved

chrisvest approved these changes Mar 23, 2026

View reviewed changes

codec-http2/src/main/java/io/netty/handler/codec/http2/Http2CodecUtil.java Outdated Show resolved Hide resolved

...-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java Outdated Show resolved Hide resolved

normanmaurer and others added 2 commits March 24, 2026 08:12

Apply suggestions from code review

d50056f

Co-authored-by: Bryce Anderson <bl_anderson@apple.com> Co-authored-by: Chris Vest <mr.chrisvest@gmail.com>

Fix checkstyle

06a9d98

normanmaurer merged commit 9f47a7b into 4.1 Mar 24, 2026
19 checks passed

normanmaurer deleted the limit_continuation_frame branch March 24, 2026 12:39

netty-project-bot mentioned this pull request Mar 24, 2026

Auto-port 5.0: Limit the number of Continuation frames per HTTP2 Headers #16535

Merged

github-actions bot removed the needs-cherry-pick-5.0 This PR should be cherry-picked to 5.0 once merged. label Mar 24, 2026

netty-project-bot mentioned this pull request Mar 24, 2026

Auto-port 4.2: Limit the number of Continuation frames per HTTP2 Headers #16536

Merged

github-actions bot removed the needs-cherry-pick-4.2 This PR should be cherry-picked to 4.2 once merged. label Mar 24, 2026

Uh oh!

Conversation

normanmaurer commented Apr 11, 2024

Uh oh!

ejona86 commented Apr 11, 2024

Uh oh!

bryce-anderson commented Apr 11, 2024

Uh oh!

chrisvest left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ejona86 left a comment

Choose a reason for hiding this comment

Uh oh!

normanmaurer commented Mar 23, 2026

Uh oh!

bryce-anderson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

chrisvest left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bryce-anderson commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

netty-project-bot commented Mar 24, 2026

Uh oh!

netty-project-bot commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

bryce-anderson commented Mar 23, 2026 •

edited

Loading