{"action":"created","issue":{"url":"https://api.github.com/repos/tatsuhiro-t/nghttp2/issues/400","labels_url":"https://api.github.com/repos/tatsuhiro-t/nghttp2/issues/400/labels{/name}","comments_url":"https://api.github.com/repos/tatsuhiro-t/nghttp2/issues/400/comments","events_url":"https://api.github.com/repos/tatsuhiro-t/nghttp2/issues/400/events","html_url":"https://github.com/tatsuhiro-t/nghttp2/issues/400","id":112507185,"number":400,"title":"Stress test using WINDOW_UPDATE","user":{"login":"erwinadi","id":15224622,"avatar_url":"https://avatars.githubusercontent.com/u/15224622?v=3","gravatar_id":"","url":"https://api.github.com/users/erwinadi","html_url":"https://github.com/erwinadi","followers_url":"https://api.github.com/users/erwinadi/followers","following_url":"https://api.github.com/users/erwinadi/following{/other_user}","gists_url":"https://api.github.com/users/erwinadi/gists{/gist_id}","starred_url":"https://api.github.com/users/erwinadi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erwinadi/subscriptions","organizations_url":"https://api.github.com/users/erwinadi/orgs","repos_url":"https://api.github.com/users/erwinadi/repos","events_url":"https://api.github.com/users/erwinadi/events{/privacy}","received_events_url":"https://api.github.com/users/erwinadi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-10-21T03:54:44Z","updated_at":"2015-10-21T12:42:34Z","closed_at":null,"body":"RFC 7540 (section 10.5 Denial-of-Service Considerations) says that WINDOW_UPDATE frames can be abused to cause an unnecessary waste of resources. Hence I attempted to witness that by modifying **libevent-client.c** and included the following line in `eventcb`:\r\n\r\n    while (1) {\r\n       nghttp2_submit_window_update(session_data->session, NGHTTP2_FLAG_NONE, 0, 16384);\r\n       session_send(session_data);\r\n    }\r\n\r\nThe client was run against **libevent-server**.  Although the loop was infinite, I observed that lots of WINDOW_UPDATE frames was received only about 30 ms. (I used tshark and tcpdump to confirm that the server machine received the packets, and to count the time-lapse of the frames). After that 30 ms, no more WINDOW_UPDATE frames was observed.\r\n\r\nIs this behavior purposely designed as a feature against the DoS Considerations in the RFC?"},"comment":{"url":"https://api.github.com/repos/tatsuhiro-t/nghttp2/issues/comments/149882982","html_url":"https://github.com/tatsuhiro-t/nghttp2/issues/400#issuecomment-149882982","issue_url":"https://api.github.com/repos/tatsuhiro-t/nghttp2/issues/400","id":149882982,"user":{"login":"tatsuhiro-t","id":404610,"avatar_url":"https://avatars.githubusercontent.com/u/404610?v=3","gravatar_id":"","url":"https://api.github.com/users/tatsuhiro-t","html_url":"https://github.com/tatsuhiro-t","followers_url":"https://api.github.com/users/tatsuhiro-t/followers","following_url":"https://api.github.com/users/tatsuhiro-t/following{/other_user}","gists_url":"https://api.github.com/users/tatsuhiro-t/gists{/gist_id}","starred_url":"https://api.github.com/users/tatsuhiro-t/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tatsuhiro-t/subscriptions","organizations_url":"https://api.github.com/users/tatsuhiro-t/orgs","repos_url":"https://api.github.com/users/tatsuhiro-t/repos","events_url":"https://api.github.com/users/tatsuhiro-t/events{/privacy}","received_events_url":"https://api.github.com/users/tatsuhiro-t/received_events","type":"User","site_admin":false},"created_at":"2015-10-21T12:42:34Z","updated_at":"2015-10-21T12:42:34Z","body":"libnghttp2 library itself has nothing to do with WINDOW_UPDATE flooding.\r\nActually, you can use other frames to cause flooding too.  Application code can do any protection they want using the frequency of received frames.\r\n\r\nThe reason why it stopped sending frames is nghttp2_submit_window_update failed because the local window size exceeded the maximum window size (2**31-1).\r\n\r\nPlease note that the above code does not work in event based application code.\r\nIn general, we must not block callback function in event loop.\r\n"}}