bneradt opened a new issue, #13443: URL: https://github.com/apache/trafficserver/issues/13443
### Problem The default value of `proxy.config.http2.max_settings_per_frame` is 7. That limit was introduced in 2019, when HTTP/2 defined six standard SETTINGS parameters. We are now seeing a large volume of production connections from Meta forward proxies whose initial SETTINGS frame contains 11 parameters. The 66-byte frame contains the usual HTTP/2 settings plus five settings from the WebTransport-over-HTTP/2 draft (`0x2b61` through `0x2b65`). Traffic Server accepts the first seven entries, rejects the eighth, and closes the connection with `ENHANCE_YOUR_CALM`: ``` HTTP/2 connection error code=0x0b stream_id=0 recv settings too many settings in a frame ``` These connections proceed to ordinary HTTP requests when the limit is raised, so this is an interoperability problem rather than malformed traffic. [RFC 9113 section 6.5.2](https://www.rfc-editor.org/rfc/rfc9113.html#section-6.5.2) allows a SETTINGS payload to contain any number of parameters and requires unsupported identifiers to be ignored. The extension identifiers are documented in the [WebTransport-over-HTTP/2 draft](https://datatracker.ietf.org/doc/html/draft-ietf-webtrans-http2-14#section-11.2). ### Proposed change Raise the default per-frame limit from 7 to 16, retaining a conservative bound while allowing room for protocol extensions. Raise `proxy.config.http2.max_settings_per_minute` from 14 to 32 to preserve the existing two-frame allowance and leave room for a legitimate settings update after the initial frame. Add an HTTP/2 AuTest that sends an 11-parameter initial SETTINGS frame and verifies that a request succeeds with the defaults. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
