plugin/https: Add max_streams to limit HTTP/2 concurrent streams (#8522)

Add a max_streams option to the *https* plugin to limit the number of
concurrent HTTP/2 streams per DoH connection. This lets operators cap
per-connection concurrency (guarding against resource exhaustion) or
raise it above the Go default for high-fan-in clients that multiplex
many requests over a single connection.

Semantics match the existing *https3* plugin's max_streams:
- omitted  -> Go HTTP/2 server default is used
- 0        -> use the underlying HTTP/2 transport default
- positive -> advertise exactly that many concurrent streams
- negative -> rejected at config parse time

The limit is applied via the standard library http.Server.HTTP2
(HTTP2Config.MaxConcurrentStreams) so it is advertised in the server's
SETTINGS frame.

Signed-off-by: Mekias Yohannes <mmyohannes@gmail.com>

core/dnsserver/config.go

@@ -114,6 +114,10 @@ type Config struct {
 	// This is nil if not specified, allowing for a default to be used.
 	MaxHTTPSConnections *int
 
+	// MaxHTTPSStreams defines the maximum number of concurrent HTTP/2 streams per HTTPS connection.
+	// This is nil if not specified, allowing for a default to be used.
+	MaxHTTPSStreams *int
+
 	// MaxHTTPS3Streams defines the maximum number of concurrent QUIC streams for HTTPS3.
 	// This is nil if not specified, allowing for a default to be used.
 	MaxHTTPS3Streams *int

core/dnsserver/config_test.go

@@ -105,6 +105,19 @@ func TestPropagateConfigParamsMaxTCPQueries(t *testing.T) {
 	}
 }
 
+func TestPropagateConfigParamsMaxHTTPSStreams(t *testing.T) {
+	n := 7
+	first := &Config{MaxHTTPSStreams: &n}
+	first.firstConfigInBlock = first
+	second := &Config{firstConfigInBlock: first}
+
+	propagateConfigParams([]*Config{first, second})
+
+	if second.MaxHTTPSStreams == nil || *second.MaxHTTPSStreams != n {
+		t.Fatalf("expected MaxHTTPSStreams to propagate to second config as %d, got %v", n, second.MaxHTTPSStreams)
+	}
+}
+
 func TestPropagateConfigParamsAllowedOpcodes(t *testing.T) {
 	first := &Config{}
 	first.firstConfigInBlock = first

core/dnsserver/register.go

@@ -296,6 +296,10 @@ func propagateConfigParams(configs []*Config) {
 		// Propagate UDPDecorateWriterFunc so a decorator configured once in a
 		// server block applies to the block's UDP listener(s).
 		c.UDPDecorateWriterFunc = c.firstConfigInBlock.UDPDecorateWriterFunc
+
+		// Propagate MaxHTTPSStreams so a `https { max_streams N }` set once in a
+		// server block applies to the block's HTTPS key regardless of key order.
+		c.MaxHTTPSStreams = c.firstConfigInBlock.MaxHTTPSStreams
 	}
 }
 

core/dnsserver/server_https.go

@@ -27,6 +27,10 @@ import (
 const (
 	// DefaultHTTPSMaxConnections is the default maximum number of concurrent connections.
 	DefaultHTTPSMaxConnections = 200
+
+	// DefaultHTTPSMaxStreams is the default maximum number of concurrent HTTP/2 streams
+	// per connection, used when max_streams is not specified.
+	DefaultHTTPSMaxStreams = 250
 )
 
 // ServerHTTPS represents an instance of a DNS-over-HTTPS server.
@@ -91,6 +95,31 @@ func NewServerHTTPS(addr string, group []*Config) (*ServerHTTPS, error) {
 		IdleTimeout:  s.IdleTimeout,
 		ErrorLog:     stdlog.New(&loggerAdapter{}, "", 0),
 	}
+	// max_streams limits the number of concurrent HTTP/2 streams per connection. When unset,
+	// DefaultHTTPSMaxStreams is applied; a value of 0 leaves the underlying HTTP/2 transport
+	// default in place; a positive value sets the limit explicitly. The chosen value is
+	// advertised in the server's SETTINGS frame. Resolve across the whole group since blocks
+	// sharing a listener share one HTTP/2 server; conflicting explicit values are rejected.
+	maxStreams := DefaultHTTPSMaxStreams
+	var resolved *int
+	for _, conf := range group {
+		if conf == nil || conf.MaxHTTPSStreams == nil {
+			continue
+		}
+		if resolved != nil && *resolved != *conf.MaxHTTPSStreams {
+			return nil, fmt.Errorf("conflicting max_streams values for shared HTTPS listener %s: %d and %d",
+				addr, *resolved, *conf.MaxHTTPSStreams)
+		}
+		resolved = conf.MaxHTTPSStreams
+	}
+	if resolved != nil {
+		maxStreams = *resolved
+	}
+	if maxStreams > 0 {
+		srv.HTTP2 = &http.HTTP2Config{
+			MaxConcurrentStreams: maxStreams,
+		}
+	}
 	maxConnections := DefaultHTTPSMaxConnections
 	if len(group) > 0 && group[0] != nil && group[0].MaxHTTPSConnections != nil {
 		maxConnections = *group[0].MaxHTTPSConnections

core/dnsserver/server_https_test.go

@@ -120,6 +120,7 @@ func TestServerHTTPSRejectsUpdate(t *testing.T) {
 
 func TestNewServerHTTPSWithCustomLimits(t *testing.T) {
 	maxConnections := 100
+	maxStreams := 100
 	c := Config{
 		Zone:                "example.com.",
 		Transport:           "https",
@@ -127,6 +128,7 @@ func TestNewServerHTTPSWithCustomLimits(t *testing.T) {
 		ListenHosts:         []string{"127.0.0.1"},
 		Port:                "443",
 		MaxHTTPSConnections: &maxConnections,
+		MaxHTTPSStreams:     &maxStreams,
 	}
 
 	server, err := NewServerHTTPS("127.0.0.1:443", []*Config{&c})
@@ -137,6 +139,12 @@ func TestNewServerHTTPSWithCustomLimits(t *testing.T) {
 	if server.maxConnections != maxConnections {
 		t.Errorf("Expected maxConnections = %d, got %d", maxConnections, server.maxConnections)
 	}
+	if server.httpsServer.HTTP2 == nil {
+		t.Fatal("Expected HTTP/2 configuration")
+	}
+	if got := server.httpsServer.HTTP2.MaxConcurrentStreams; got != maxStreams {
+		t.Errorf("Expected MaxConcurrentStreams = %d, got %d", maxStreams, got)
+	}
 }
 
 func TestNewServerHTTPSDefaults(t *testing.T) {
@@ -179,6 +187,122 @@ func TestNewServerHTTPSZeroLimits(t *testing.T) {
 	}
 }
 
+func TestNewServerHTTPSZeroStreams(t *testing.T) {
+	// max_streams 0 means "use the underlying HTTP/2 transport default": we must NOT
+	// explicitly configure HTTP/2 (so Go's built-in default of 250 applies).
+	zero := 0
+	c := Config{
+		Zone:            "example.com.",
+		Transport:       "https",
+		TLSConfig:       &tls.Config{},
+		ListenHosts:     []string{"127.0.0.1"},
+		Port:            "443",
+		MaxHTTPSStreams: &zero,
+	}
+
+	server, err := NewServerHTTPS("127.0.0.1:443", []*Config{&c})
+	if err != nil {
+		t.Fatalf("NewServerHTTPS() with zero streams failed: %v", err)
+	}
+
+	if server.httpsServer.HTTP2 != nil {
+		t.Errorf("Expected no explicit HTTP/2 configuration for max_streams 0 (transport default), got MaxConcurrentStreams = %d",
+			server.httpsServer.HTTP2.MaxConcurrentStreams)
+	}
+}
+
+func TestNewServerHTTPSDefaultStreams(t *testing.T) {
+	// max_streams omitted means the CoreDNS default (DefaultHTTPSMaxStreams) is applied.
+	c := Config{
+		Zone:        "example.com.",
+		Transport:   "https",
+		TLSConfig:   &tls.Config{},
+		ListenHosts: []string{"127.0.0.1"},
+		Port:        "443",
+	}
+
+	server, err := NewServerHTTPS("127.0.0.1:443", []*Config{&c})
+	if err != nil {
+		t.Fatalf("NewServerHTTPS() failed: %v", err)
+	}
+
+	if server.httpsServer.HTTP2 == nil {
+		t.Fatal("Expected HTTP/2 configuration with the default max streams")
+	}
+	if got := server.httpsServer.HTTP2.MaxConcurrentStreams; got != DefaultHTTPSMaxStreams {
+		t.Errorf("Expected default MaxConcurrentStreams = %d, got %d", DefaultHTTPSMaxStreams, got)
+	}
+}
+
+func TestNewServerHTTPSStreamsAcrossGroup(t *testing.T) {
+	// Blocks sharing a listener are passed as one group and share one HTTP/2
+	// connection, so the limit must resolve to a single value regardless of
+	// which member carries it, and conflicting values must be rejected.
+	intPtr := func(v int) *int { return &v }
+	streamsConfig := func(zone string, v *int) *Config {
+		return &Config{
+			Zone:            zone,
+			Transport:       "https",
+			TLSConfig:       &tls.Config{},
+			ListenHosts:     []string{"127.0.0.1"},
+			Port:            "443",
+			MaxHTTPSStreams: v,
+		}
+	}
+
+	tests := []struct {
+		name      string
+		group     []*Config
+		shouldErr bool
+		want      int
+	}{
+		{
+			name:  "set on first member",
+			group: []*Config{streamsConfig("first.example.", intPtr(7)), streamsConfig("second.example.", nil)},
+			want:  7,
+		},
+		{
+			name:  "set on second member",
+			group: []*Config{streamsConfig("first.example.", nil), streamsConfig("second.example.", intPtr(7))},
+			want:  7,
+		},
+		{
+			name:  "omitted on all members",
+			group: []*Config{streamsConfig("first.example.", nil), streamsConfig("second.example.", nil)},
+			want:  DefaultHTTPSMaxStreams,
+		},
+		{
+			name:      "conflicting values",
+			group:     []*Config{streamsConfig("first.example.", intPtr(7)), streamsConfig("second.example.", intPtr(9))},
+			shouldErr: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			server, err := NewServerHTTPS("127.0.0.1:443", tc.group)
+			if tc.shouldErr {
+				if err == nil {
+					t.Fatal("Expected error for conflicting max_streams values, got nil")
+				}
+				if !strings.Contains(err.Error(), "conflicting max_streams") {
+					t.Errorf("Expected a conflicting max_streams error, got: %v", err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("NewServerHTTPS() failed: %v", err)
+			}
+			if server.httpsServer.HTTP2 == nil {
+				t.Fatal("Expected HTTP/2 configuration")
+			}
+			if got := server.httpsServer.HTTP2.MaxConcurrentStreams; got != tc.want {
+				t.Errorf("Expected MaxConcurrentStreams = %d, got %d", tc.want, got)
+			}
+		})
+	}
+}
+
 type contextCapturingPlugin struct {
 	capturedContext  context.Context
 	contextCancelled bool