pjfanning opened a new pull request, #1261: URL: https://github.com/apache/pekko-http/pull/1261
### Motivation `Http2FrameParsing` read the stream identifier with a plain `readIntBE()`, keeping the reserved high bit, and carried a TODO saying the bit should be checked: ```scala val streamId = reader.readIntBE() // TODO: assert that reserved bit is 0 by checking if streamId > 0 ``` RFC 9113 §5.1.1 says the bit is reserved and **MUST be ignored** when receiving. Keeping it means a peer that sets it produces a negative stream id, which never matches the stream the frame is really for: `streamFor` treats it as closed and the connection is failed with a GOAWAY instead of the frame being handled on its stream. ### Modification Mask the reserved bit off (`& 0x7FFFFFFF`) when reading the identifier, and replace the TODO with the rule it was standing in for. ### Result A frame whose stream identifier carries the reserved bit is handled on the stream it names, as the spec requires, rather than failing the connection. ### Tests - `sbt "http2-tests/testOnly org.apache.pekko.http.impl.engine.http2.Http2ServerSpec org.apache.pekko.http.impl.engine.http2.Http2ClientSpec org.apache.pekko.http.impl.engine.http2.framing.Http2FramingSpec"` — pass (189 tests). A new test sends HEADERS for stream 1 with the reserved bit set and expects the request to be dispatched. Verified it fails with the fix stashed (the connection is failed instead). - `sbt http-core/mimaReportBinaryIssues` — pass (internal `impl.engine.http2` change, no public API). - Native `scalafmt` on the changed files — clean. ### References None - ignores the reserved stream identifier bit per RFC 9113 §5.1.1 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
