Skip to content

atenet-router: limit HTTP/2 streams and windows on client HCMs - #3726

Open
botengyao wants to merge 1 commit into
agent-substrate:mainfrom
botengyao:ingress-hcm-hardening
Open

botengyao wants to merge 1 commit into
agent-substrate:mainfrom
botengyao:ingress-hcm-hardening

Conversation

@botengyao

Copy link
Copy Markdown
Collaborator

The router's client-facing HCMs (ingress_https, main_internal, connect_terminate_tls) set no HTTP/2 limits. With Envoy's defaults, one client connection can open 2^31-1 streams, and each stream and connection gets a 256 MiB flow-control window. This sets max_concurrent_streams: 100 and 1 MiB stream and connection windows, the values atenet-egress already uses.

AI use: AI-assisted, I reviewed and tested it.

  • Tests pass
  • Docs updated

Envoy's HTTP/2 defaults allow 2^31-1 streams and 256 MiB windows per
connection on the client-facing HCMs. Use the atenet-egress values
instead.

Signed-off-by: botengyao <botengyao@gmail.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant