apache / apache/trafficserver

HTTP/2: DATA sent to closed streams is never credited back to the connection window

Open
#13,640 0 comments 0 reactions 0 assignees View on GitHub
Bug HTTP/2
Dominant language
C++
Stars
2k
Forks
874
Avg merge
6d 15h
Merged PRs (30d)
46

Description

### Summary

When an HTTP/2 peer sends a DATA frame on a stream that ATS has already closed, `Http2ConnectionState::rcv_data_frame()` charges the payload against the connection receive window (`decrement_local_rwnd()` at the top of the function) and then discards the frame with a `RST_STREAM(STREAM_CLOSED)`. Charging the bytes is what RFC 9113 section 6.9 requires, but no stream ever consumes them, so nothing calls `restart_receiving()` for those bytes and no connection-level `WINDOW_UPDATE` is ever sent for them.

### Impact

A client that keeps sending DATA to closed streams can run the connection window down to zero and stall its own connection. The window is only restored when some other stream on that connection makes progress and triggers `restart_receiving()`, or on the every-128-frames path in `Http2CommonSession`. Well-behaved clients can also hit this accidentally: if ATS resets a stream while an upload is still in flight, the in-flight DATA is discarded and permanently deducted from the connection window as the client sees it.

This is scoped to the affected connection only; it does not affect other connections or users. It is a robustness bug, not a security issue.

### Expected behavior

Discarded DATA should be credited back to the connection window promptly so the connection window stays synchronized between both endpoints and DATA to closed streams cannot drain it.

### Reproduction

1. Open an HTTP/2 connection and complete a request on stream 1.
2. Send DATA frames on stream 1 (now closed), honoring the connection send window as advertised by ATS.
3. After 65535 bytes the client's connection send window reaches zero and ATS never sends a connection `WINDOW_UPDATE`. A subsequent request with a body cannot send its DATA.

An AuTest client that does this is included in the fix PR.

Contributor guide

Open the contributing guide

Research direction

Start at Http2ConnectionState::rcv_data_frame() and trace decrement_local_rwnd() and restart_receiving(). Reproduce the described sequence by sending DATA on a closed stream, then verify that discarded bytes promptly cause a connection-level WINDOW_UPDATE and that a subsequent request with a body is not stalled.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.