g3-dpi: limit range of h2 max-frame-size config value

bytedance · Feb 5, 2025 · e7adbb1 · e7adbb1
1 parent e5a0b15
commit e7adbb1
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 7 deletions.
diff --git a/g3proxy/src/inspect/http/v2/mod.rs b/g3proxy/src/inspect/http/v2/mod.rs
@@ -208,7 +208,7 @@ where
         server_builder
             .max_header_list_size(http_config.max_header_list_size)
             .max_concurrent_streams(1)
-            .max_frame_size(http_config.max_frame_size)
+            .max_frame_size(http_config.max_frame_size())
             .max_send_buffer_size(http_config.max_send_buffer_size);
 
         match tokio::time::timeout(
@@ -257,7 +257,7 @@ where
         server_builder
             .max_header_list_size(http_config.max_header_list_size)
             .max_concurrent_streams(1)
-            .max_frame_size(http_config.max_frame_size)
+            .max_frame_size(http_config.max_frame_size())
             .max_send_buffer_size(http_config.max_send_buffer_size);
 
         let mut h2c = match tokio::time::timeout(
@@ -294,7 +294,7 @@ where
             .enable_push(false) // server push is deprecated by chrome and nginx
             .max_header_list_size(http_config.max_header_list_size)
             .max_concurrent_streams(http_config.max_concurrent_streams)
-            .max_frame_size(http_config.max_frame_size)
+            .max_frame_size(http_config.max_frame_size())
             .max_send_buffer_size(http_config.max_send_buffer_size);
         if http_config.disable_upstream_push {
             client_builder.enable_push(false);
@@ -318,7 +318,7 @@ where
         server_builder
             .max_header_list_size(http_config.max_header_list_size)
             .max_concurrent_streams(max_concurrent_recv_streams)
-            .max_frame_size(http_config.max_frame_size)
+            .max_frame_size(http_config.max_frame_size())
             .max_send_buffer_size(http_config.max_send_buffer_size);
         if h2s.is_extended_connect_protocol_enabled() {
             server_builder.enable_connect_protocol();

diff --git a/lib/g3-dpi/src/config/http.rs b/lib/g3-dpi/src/config/http.rs
@@ -48,7 +48,7 @@ impl Default for H1InterceptionConfig {
 pub struct H2InterceptionConfig {
     pub max_header_list_size: u32,
     pub max_concurrent_streams: u32,
-    pub max_frame_size: u32,
+    max_frame_size: u32,
     pub max_send_buffer_size: usize,
     pub disable_upstream_push: bool,
     pub upstream_handshake_timeout: Duration,
@@ -74,3 +74,14 @@ impl Default for H2InterceptionConfig {
         }
     }
 }
+
+impl H2InterceptionConfig {
+    #[inline]
+    pub fn max_frame_size(&self) -> u32 {
+        self.max_frame_size
+    }
+
+    pub fn set_max_frame_size(&mut self, size: u32) {
+        self.max_frame_size = size.clamp(1 << 14, (1 << 24) - 1);
+    }
+}
diff --git a/lib/g3-yaml/src/value/dpi/http.rs b/lib/g3-yaml/src/value/dpi/http.rs
@@ -88,8 +88,9 @@ pub fn as_h2_interception_config(value: &Yaml) -> anyhow::Result<H2InterceptionC
                 Ok(())
             }
             "max_frame_size" => {
-                config.max_frame_size = crate::humanize::as_u32(v)
+                let max_frame_size = crate::humanize::as_u32(v)
                     .context(format!("invalid humanize u32 value for key {k}"))?;
+                config.set_max_frame_size(max_frame_size);
                 Ok(())
             }
             "max_send_buffer_size" => {

diff --git a/sphinx/g3proxy/configuration/values/dpi.rst b/sphinx/g3proxy/configuration/values/dpi.rst
@@ -733,7 +733,9 @@ The keys are:
 
   Set the max frame size.
 
-  **default**: 1MiB
+  **default**: 1MiB, **min**: 16K, **max**: 16M - 1
+
+  .. versionchanged:: 1.11.3 adjust the value to be in the range *min*-*max* automatically
 
 * max_send_buffer_size