The HTTP/2 spec (RFC 7540) defines SETTINGS_INITIAL_WINDOW_SIZE
maximum as 2^31-1. Values above this must be treated as a
FLOW_CONTROL_ERROR. Previously, Node.js allowed values up to
2^32-1 which caused nghttp2_submit_settings() to return
NGHTTP2_ERR_INVALID_ARGUMENT, triggering an uncatchable
assertion failure and crashing the process.
This change adds proper validation to reject values >= 2^31
with a catchable RangeError before they reach nghttp2.
PR-URL: https://github.com/nodejs/node/pull/61402
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Tim Perry <pimterry@gmail.com>
* cleanup constants in http2 binding
The error constants were just doing some weird things. Cleanup
and improve maintainability.
* simplify settings to reduce duplicate code
* improve style consistency and correctness
Use snake_case for getters and setters at c++ level,
avoid unnecessary use of enums,
use consistent style for exported vs. internal constants,
avoid unnecessary memory info reporting,
use setters/getters for flags_ for improved code readability
* make EmitStatistics function private
* un-nest Http2Settings and Http2Ping
* refactoring and cleanup of Http2Settings and Http2Ping
* avoid ** syntax for readability
The **session and **stream syntax for getting the underlying
nghttp2 pointers is not ideal for readability
* use const references for Http2Priority
* remove unnecessary GetStream function
* refactor Http2Scope to use BaseObjectPtr
* move utility function to anonymous namespace
* refactor and simplify Origins
* Use an AllocatedBuffer instead of MaybeStackBuffer
* Use a const reference instead of pointer
* use BaseObjectPtr for Http2Streams map
* move MemoryInfo impl to cc
Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/32884
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
This completely refactors the `expectsError` behavior: so far it's
almost identical to `assert.throws(fn, object)` in case it was used
with a function as first argument. It had a magical property check
that allowed to verify a functions `type` in case `type` was passed
used in the validation object. This pattern is now completely removed
and `assert.throws()` should be used instead.
The main intent for `common.expectsError()` is to verify error cases
for callback based APIs. This is now more flexible by accepting all
validation possibilites that `assert.throws()` accepts as well. No
magical properties exist anymore. This reduces surprising behavior
for developers who are not used to the Node.js core code base.
This has the side effect that `common` is used significantly less
frequent.
PR-URL: https://github.com/nodejs/node/pull/31092
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
ERR_INVALID_ARG_TYPE is the most common error used throughout the
code base. This improves the error message by providing more details
to the user and by indicating more precisely which values are allowed
ones and which ones are not.
It adds the actual input to the error message in case it's a primitive.
If it's a class instance, it'll print the class name instead of
"object" and "falsy" or similar entries are not named "type" anymore.
PR-URL: https://github.com/nodejs/node/pull/29675
Reviewed-By: Rich Trott <rtrott@gmail.com>
This makes a effort to make sure all of these errors will actually
also show the received input.
On top of that it refactors a few tests for better maintainability.
It will also change the returned type to always be a simple typeof
instead of special handling null.
PR-URL: https://github.com/nodejs/node/pull/19445
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
This update does several significant things:
1. It eliminates the base Nghttp2* classes and folds those
in to node::http2::Http2Session and node::http2::Http2Stream
2. It makes node::http2::Http2Stream a StreamBase instance and
sends that out to JS-land to act as the [kHandle] for the
JavaScript Http2Stream class.
3. It shifts some of the callbacks from C++ off of the JavaScript
Http2Session class to the Http2Stream class.
4. It refactors the data provider structure for FD and Stream
based sending to help encapsulate those functions easier
5. It streamlines some of the functions at the C++ layer to
eliminate now unnecessary redirections
6. It cleans up node_http2.cc for better readability and
maintainability
7. It refactors some of the debug output
8. Because Http2Stream instances are now StreamBases, they are
now also trackable using async-hooks
9. The Stream::OnRead algorithm has been simplified with a
couple bugs fixed.
10. I've eliminated node_http2_core.h and node_http2_core-inl.h
11. Detect invalid handshake a report protocol error to session
12. Refactor out of memory error, improve other errors
13. Add Http2Session.prototype.ping
PR-URL: https://github.com/nodejs/node/pull/17105
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Sebastiaan Deckers <sebdeckers83@gmail.com>
* eliminate pooling of Nghttp2Stream instances. After testing,
the pooling is not having any tangible benefit
and makes things more complicated. Simplify. Simplify.
* refactor inbound headers
* Enforce MAX_HEADERS_LIST setting and limit the number of header
pairs accepted from the peer. Use the ENHANCE_YOUR_CALM error
code when receiving either too many headers or too many octets.
Use a vector to store the headers instead of a queue
PR-URL: https://github.com/nodejs/node/pull/16676
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
When building --without-ssl and running the tests some of the http2 test
fail with the following error message:
internal/util.js:82
throw new errors.Error('ERR_NO_CRYPTO');
^
Error [ERR_NO_CRYPTO]: Node.js is not compiled with OpenSSL crypto
support
at Object.assertCrypto (internal/util.js:82:11)
at internal/http2/core.js:5:26
at NativeModule.compile (bootstrap_node.js:586:7)
at NativeModule.require (bootstrap_node.js:531:18)
at http2.js:17:5
at NativeModule.compile (bootstrap_node.js:586:7)
at Function.NativeModule.require (bootstrap_node.js:531:18)
at Function.Module._load (module.js:449:25)
at Module.require (module.js:517:17)
at require (internal/module.js:11:18)
This commit adds hasCrypto checks and skips the tests if there is no
crypto support.
PR-URL: https://github.com/nodejs/node/pull/14657
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Matteo Collina