The GitHub Actions job "Scalafmt" on pekko-http.git/http2-max-resets has succeeded. Run started by GitHub user pjfanning (triggered by pjfanning).
Head commit for run: 61442662c6f1277f1d1676ab08de84a5e34f0c48 / PJ Fanning <[email protected]> add HTTP/2 server max-resets limit as an alternative rapid reset protection Motivation: akka/akka-http#4324 protects against HTTP/2 Rapid Reset (CVE-2023-44487) by counting RST_STREAM frames per connection and closing the connection with ENHANCE_YOUR_CALM when a limit is exceeded. Pekko HTTP already has a different mechanism for this, the frame-type-throttle. Modification: - Add pekko.http.server.http2.max-resets / max-resets-interval settings (disabled by default with max-resets = 0) with Scala and Java accessors. - Port RSTFrameLimit from akka-http and add it to the server stack, below the frame type throttle, when max-resets > 0. - Add specs for the limit on its own and together with the throttle. Result: Users can opt in to a reset limit that closes abusive connections with ENHANCE_YOUR_CALM. How it should coexist with frame-type-throttle is an open question (see PR). Tests: - sbt "http2-tests/Test/testOnly org.apache.pekko.http.impl.engine.http2.Http2ServerMaxResets*": 5 passed (Scala 2.13 and 3.3.8) - Without the Http2Blueprint wiring: both ENHANCE_YOUR_CALM tests fail (directional) - sbt "http2-tests/Test/testOnly ...Http2Server*FrameTypeThrottleSpec": pass - sbt http-core/mimaReportBinaryIssues: pass (with new excludes file) - scalafmt: no changes References: Refs akka/akka-http#4324, akka/akka-http#4323 (Apache 2.0 since the Akka HTTP 10.6.0 change date, 2026-10-23) Report URL: https://github.com/apache/pekko-http/actions/runs/39926761878 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
