Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Configuration Options for HTTP/1 Max Headers and Buffer Limits #6194

Merged
merged 34 commits into from
Nov 19, 2024
Merged
Changes from 1 commit
Commits
Show all changes
34 commits
Select commit Hold shift + click to select a range
236d560
update hyper to 0.14.31
IvanGoncharov Oct 24, 2024
b66c3f2
Adds `supergraph.experimental_http1_max_headers` option
IvanGoncharov Oct 24, 2024
03760c7
fix lint
IvanGoncharov Oct 24, 2024
2d3e901
Merge branch 'dev' into i1g/max_headers
IvanGoncharov Nov 5, 2024
1969f11
Add experimental_http1_max_buf_size
IvanGoncharov Nov 7, 2024
987e0bb
fix format
IvanGoncharov Nov 7, 2024
22b8239
Use tagged release on our organization
abernix Nov 8, 2024
e39447b
Merge branch 'dev' into i1g/max_headers
abernix Nov 8, 2024
e20fd0b
Merge branch 'dev' into i1g/max_headers
IvanGoncharov Nov 13, 2024
1de4a55
remove duplication in Cargo.toml
IvanGoncharov Nov 13, 2024
199fca0
fix lint
Nov 13, 2024
9d0115a
fix compile error
Nov 13, 2024
9344ef0
Update snapshot
Nov 13, 2024
c0bac69
fix tests
Nov 13, 2024
1491ac0
human-friendly config
Nov 13, 2024
67bdb1f
Add docs
Nov 14, 2024
941aa16
Add crate feature
Nov 14, 2024
f286960
review changes
Nov 14, 2024
1d0bf1f
add feature flag to xtask commands
Nov 14, 2024
6837adf
Apply suggestions from code review
IvanGoncharov Nov 14, 2024
e5c8bd0
Merge branch 'dev' into i1g/max_headers
IvanGoncharov Nov 14, 2024
450b7e7
pass experimental_hyper_header_limits feature to xtask commands
IvanGoncharov Nov 18, 2024
274f062
fix xtask build
IvanGoncharov Nov 18, 2024
2d2c2bf
Merge branch 'dev' into i1g/max_headers
IvanGoncharov Nov 18, 2024
725f510
Update snapshot
IvanGoncharov Nov 18, 2024
c445493
Add missing changeset
IvanGoncharov Nov 18, 2024
ac1b5ac
Fix tests failing without feature flag
IvanGoncharov Nov 18, 2024
c31ce67
Switch kb => kib in tests and docs
IvanGoncharov Nov 18, 2024
e44b154
Revert unwanted changes in Cargo.lock
IvanGoncharov Nov 18, 2024
bea7a96
Merge branch 'dev' into i1g/max_headers
IvanGoncharov Nov 18, 2024
27ef7ab
Address review on changelog
IvanGoncharov Nov 18, 2024
0d2709b
Drop experimental prefix
IvanGoncharov Nov 18, 2024
cdf4e19
experimental_hyper_header_limits => hyper_header_limits
IvanGoncharov Nov 18, 2024
bd686e5
fix CI after removing experimental_
IvanGoncharov Nov 18, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
review changes
  • Loading branch information
Ivan Goncharov authored and Ivan Goncharov committed Nov 14, 2024
commit f286960ab75b24ceb2e81dbcccd95bbee6a32376
2 changes: 1 addition & 1 deletion apollo-router/Cargo.toml
Original file line number Diff line number Diff line change
@@ -52,7 +52,7 @@ docs_rs = ["router-bridge/docs_rs"]
# and not yet ready for production use.
telemetry_next = []

experimental_hyper_fork = []
experimental_hyper_header_limits = []

# is set when ci builds take place. It allows us to disable some tests when CI is running on certain platforms.
ci = []
Original file line number Diff line number Diff line change
@@ -304,7 +304,7 @@ impl HttpServerFactory for AxumHttpServerFactory {
http_config.http1_keep_alive(true);
http_config.http1_header_read_timeout(Duration::from_secs(10));

#[cfg(feature = "experimental_hyper_fork")]
#[cfg(feature = "experimental_hyper_header_limits")]
if let Some(max_headers) = configuration.limits.experimental_http1_max_request_headers {
http_config.http1_max_headers(max_headers);
}
6 changes: 3 additions & 3 deletions apollo-router/src/configuration/mod.rs
Original file line number Diff line number Diff line change
@@ -492,11 +492,11 @@ impl Configuration {

impl Configuration {
pub(crate) fn validate(self) -> Result<Self, ConfigurationError> {
#[cfg(not(feature = "experimental_hyper_fork"))]
#[cfg(not(feature = "experimental_hyper_header_limits"))]
if self.limits.experimental_http1_max_request_headers.is_some() {
return Err(ConfigurationError::InvalidConfiguration {
message: "'limits.experimental_http1_max_request_headers' requires 'experimental_hyper_fork' feature",
error: "enable 'experimental_hyper_fork' feature in order to use 'limits.experimental_http1_max_request_headers'".to_string(),
message: "'limits.experimental_http1_max_request_headers' requires 'experimental_hyper_header_limits' feature",
error: "enable 'experimental_hyper_header_limits' feature in order to use 'limits.experimental_http1_max_request_headers'".to_string(),
});
}

Original file line number Diff line number Diff line change
@@ -1318,15 +1318,15 @@ snapshot_kind: text
"additionalProperties": false,
"description": "Configuration for operation limits, parser limits, HTTP limits, etc.",
"properties": {
"experimental_http1_max_buf_size": {
"experimental_http1_max_request_buf_size": {
"default": null,
"description": "Set the maximum buffer size for the HTTP1 connection.\n\nDefault is ~400kb.",
"description": "Limit the maximum buffer size for the HTTP1 connection.\n\nDefault is ~400kb.",
"nullable": true,
"type": "string"
},
"experimental_http1_max_headers": {
"experimental_http1_max_request_headers": {
"default": null,
"description": "Set the maximum number of headers for HTTP1 protocol\n\nIf server receives more headers than the buffer size, it responds to the client with \"431 Request Header Fields Too Large\".\n\nDefault is 100.",
"description": "Limit the maximum number of headers of incoming HTTP1 requests. Default is 100.\n\nIf router receives more headers than the buffer size, it responds to the client with \"431 Request Header Fields Too Large\".",
"format": "uint",
"minimum": 0.0,
"nullable": true,
8 changes: 4 additions & 4 deletions apollo-router/tests/integration/supergraph.rs
Original file line number Diff line number Diff line change
@@ -5,7 +5,7 @@ use tower::BoxError;

use crate::integration::IntegrationTest;

#[cfg(not(feature = "experimental_hyper_fork"))]
#[cfg(not(feature = "experimental_hyper_header_limits"))]
#[tokio::test(flavor = "multi_thread")]
async fn test_supergraph_error_http1_max_headers_config() -> Result<(), BoxError> {
let mut router = IntegrationTest::builder()
@@ -19,12 +19,12 @@ async fn test_supergraph_error_http1_max_headers_config() -> Result<(), BoxError
.await;

router.start().await;
router.assert_log_contains("'limits.experimental_http1_max_request_headers' requires 'experimental_hyper_fork' feature: enable 'experimental_hyper_fork' feature in order to use 'limits.experimental_http1_max_request_headers'").await;
router.assert_log_contains("'limits.experimental_http1_max_request_headers' requires 'experimental_hyper_header_limits' feature: enable 'experimental_hyper_header_limits' feature in order to use 'limits.experimental_http1_max_request_headers'").await;
router.assert_not_started().await;
Ok(())
}

#[cfg(feature = "experimental_hyper_fork")]
#[cfg(feature = "experimental_hyper_header_limits")]
#[tokio::test(flavor = "multi_thread")]
async fn test_supergraph_errors_on_http1_max_headers() -> Result<(), BoxError> {
let mut router = IntegrationTest::builder()
@@ -52,7 +52,7 @@ async fn test_supergraph_errors_on_http1_max_headers() -> Result<(), BoxError> {
Ok(())
}

#[cfg(feature = "experimental_hyper_fork")]
#[cfg(feature = "experimental_hyper_header_limits")]
#[tokio::test(flavor = "multi_thread")]
async fn test_supergraph_allow_to_change_http1_max_headers() -> Result<(), BoxError> {
let mut router = IntegrationTest::builder()
4 changes: 2 additions & 2 deletions docs/source/reference/router/configuration.mdx
Original file line number Diff line number Diff line change
@@ -1114,8 +1114,8 @@ The router rejects any request that violates at least one of these limits.
limits:
# Network-based limits
http_max_request_bytes: 2000000 # Default value: 2 MB
experimental_http1_max_headers: 200 # Default value: 100
experimental_http1_max_buf_size: 800kb # Default value: 400kb
experimental_http1_max_request_headers: 200 # Default value: 100
experimental_http1_max_request_buf_size: 800kb # Default value: 400kb

# Parser-based limits
parser_max_tokens: 15000 # Default value
4 changes: 2 additions & 2 deletions docs/source/routing/security/request-limits.mdx
Original file line number Diff line number Diff line change
@@ -15,8 +15,8 @@ For enhanced security, the GraphOS Router can reject requests that violate any o
limits:
# Network-based limits
http_max_request_bytes: 2000000 # Default value: 2 MB
experimental_http1_max_headers: 200 # Default value: 100
experimental_http1_max_buf_size: 800kb # Default value: 400kb
experimental_http1_max_request_headers: 200 # Default value: 100
experimental_http1_max_request_buf_size: 800kb # Default value: 400kb

# Parser-based limits
parser_max_tokens: 15000 # Default value