|
| 1 | +'use strict'; |
| 2 | + |
| 3 | +const common = require('../common'); |
| 4 | + |
| 5 | +if (!common.hasCrypto) |
| 6 | + common.skip('missing crypto'); |
| 7 | + |
| 8 | +const http2 = require('http2'); |
| 9 | +const net = require('net'); |
| 10 | + |
| 11 | +// When nghttp2 internally sends a GOAWAY frame due to a protocol error, it |
| 12 | +// may call nghttp2_session_terminate_session() directly, bypassing the |
| 13 | +// on_invalid_frame_recv_callback entirely. This test ensures that even |
| 14 | +// in that scenario, we still correctly clean up the session & connection. |
| 15 | +// |
| 16 | +// This test reproduces this with a client who sends a frame header with |
| 17 | +// a length exceeding the default max_frame_size (16384). nghttp2 responds |
| 18 | +// with GOAWAY(FRAME_SIZE_ERROR) without notifying Node through any callback. |
| 19 | + |
| 20 | +const server = http2.createServer(); |
| 21 | + |
| 22 | +server.on('session', common.mustCall((session) => { |
| 23 | + session.on('error', common.expectsError({ |
| 24 | + code: 'ERR_HTTP2_ERROR', |
| 25 | + name: 'Error', |
| 26 | + message: 'Protocol error' |
| 27 | + })); |
| 28 | + |
| 29 | + session.on('close', common.mustCall(() => server.close())); |
| 30 | +})); |
| 31 | + |
| 32 | +server.listen(0, common.mustCall(() => { |
| 33 | + const conn = net.connect({ |
| 34 | + port: server.address().port, |
| 35 | + allowHalfOpen: true, |
| 36 | + }); |
| 37 | + |
| 38 | + // HTTP/2 client connection preface. |
| 39 | + conn.write('PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n'); |
| 40 | + |
| 41 | + // Empty SETTINGS frame. |
| 42 | + const settingsFrame = Buffer.alloc(9); |
| 43 | + settingsFrame[3] = 0x04; // type: SETTINGS |
| 44 | + conn.write(settingsFrame); |
| 45 | + |
| 46 | + let inbuf = Buffer.alloc(0); |
| 47 | + let state = 'settingsHeader'; |
| 48 | + let settingsFrameLength; |
| 49 | + |
| 50 | + conn.on('data', (chunk) => { |
| 51 | + inbuf = Buffer.concat([inbuf, chunk]); |
| 52 | + |
| 53 | + switch (state) { |
| 54 | + case 'settingsHeader': |
| 55 | + if (inbuf.length < 9) return; |
| 56 | + settingsFrameLength = inbuf.readUIntBE(0, 3); |
| 57 | + inbuf = inbuf.slice(9); |
| 58 | + state = 'readingSettings'; |
| 59 | + // Fallthrough |
| 60 | + case 'readingSettings': { |
| 61 | + if (inbuf.length < settingsFrameLength) return; |
| 62 | + inbuf = inbuf.slice(settingsFrameLength); |
| 63 | + state = 'done'; |
| 64 | + |
| 65 | + // ACK the server SETTINGS. |
| 66 | + const ack = Buffer.alloc(9); |
| 67 | + ack[3] = 0x04; // type: SETTINGS |
| 68 | + ack[4] = 0x01; // flag: ACK |
| 69 | + conn.write(ack); |
| 70 | + |
| 71 | + // Send a HEADERS frame header claiming length 16385, which exceeds |
| 72 | + // the default max_frame_size of 16384. nghttp2 checks the length |
| 73 | + // before reading any payload, so no body is needed. This triggers |
| 74 | + // nghttp2_session_terminate_session(FRAME_SIZE_ERROR) directly in |
| 75 | + // nghttp2_session_mem_recv2 — bypassing on_invalid_frame_recv_callback. |
| 76 | + const oversized = Buffer.alloc(9); |
| 77 | + oversized.writeUIntBE(16385, 0, 3); // length: 16385 (one over max) |
| 78 | + oversized[3] = 0x01; // type: HEADERS |
| 79 | + oversized[4] = 0x04; // flags: END_HEADERS |
| 80 | + oversized.writeUInt32BE(1, 5); // stream id: 1 |
| 81 | + conn.write(oversized); |
| 82 | + |
| 83 | + // No need to write the data - the header alone triggers the check. |
| 84 | + } |
| 85 | + } |
| 86 | + }); |
| 87 | + |
| 88 | + // The server must close the connection after sending GOAWAY: |
| 89 | + conn.on('end', common.mustCall(() => conn.end())); |
| 90 | + conn.on('close', common.mustCall()); |
| 91 | +})); |
0 commit comments