plugin/https: Add max_streams to limit HTTP/2 concurrent streams (#8522)

Add a max_streams option to the *https* plugin to limit the number of
concurrent HTTP/2 streams per DoH connection. This lets operators cap
per-connection concurrency (guarding against resource exhaustion) or
raise it above the Go default for high-fan-in clients that multiplex
many requests over a single connection.

Semantics match the existing *https3* plugin's max_streams:
- omitted  -> Go HTTP/2 server default is used
- 0        -> use the underlying HTTP/2 transport default
- positive -> advertise exactly that many concurrent streams
- negative -> rejected at config parse time

The limit is applied via the standard library http.Server.HTTP2
(HTTP2Config.MaxConcurrentStreams) so it is advertised in the server's
SETTINGS frame.

Signed-off-by: Mekias Yohannes <mmyohannes@gmail.com>

plugin/https/README.md

@@ -14,33 +14,37 @@ This plugin can only be used once per HTTPS listener block.
 
 ```txt
 https {
-    max_connections POSITIVE_INTEGER
+    max_connections NON_NEGATIVE_INTEGER
+    max_streams NON_NEGATIVE_INTEGER
 }
 ```
 
 * `max_connections` limits the number of concurrent TCP connections to the HTTPS server. The default value is 200 if not specified. Set to 0 for unbounded.
+* `max_streams` limits the number of concurrent HTTP/2 streams per HTTPS connection. This helps prevent unbounded streams on a single connection, exhausting server resources. The default value is 250 if not specified. Set to 0 to use the underlying HTTP/2 transport default.
 
 ## Examples
 
-Set custom limits for maximum connections:
+Set custom limits for maximum connections and streams:
 
 ```
 https://.:443 {
     tls cert.pem key.pem
     https {
         max_connections 100
+        max_streams 100
     }
     whoami
 }
 ```
 
-Set values to 0 for unbounded, matching CoreDNS behaviour before v1.14.0:
+Set both values to 0 to disable the CoreDNS limits (unbounded connections and the underlying HTTP/2 transport stream default), matching CoreDNS behaviour before v1.14.0:
 
 ```
 https://.:443 {
     tls cert.pem key.pem
     https {
         max_connections 0
+        max_streams 0
     }
     whoami
 }

plugin/https/setup.go

@@ -1,6 +1,7 @@
 package https
 
 import (
+	"math"
 	"strconv"
 
 	"github.com/coredns/caddy"
@@ -54,6 +55,25 @@ func parseDOH(c *caddy.Controller) error {
 				return c.Err("max_connections already defined for this server block")
 			}
 			config.MaxHTTPSConnections = &val
+		case "max_streams":
+			args := c.RemainingArgs()
+			if len(args) != 1 {
+				return c.ArgErr()
+			}
+			val, err := strconv.Atoi(args[0])
+			if err != nil {
+				return c.Errf("invalid max_streams value '%s': %v", args[0], err)
+			}
+			if val < 0 {
+				return c.Errf("max_streams must be a non-negative integer: %d", val)
+			}
+			if int64(val) > math.MaxUint32 {
+				return c.Errf("max_streams must not exceed %d: %d", uint64(math.MaxUint32), val)
+			}
+			if config.MaxHTTPSStreams != nil {
+				return c.Err("max_streams already defined for this server block")
+			}
+			config.MaxHTTPSStreams = &val
 		default:
 			return c.Errf("unknown property '%s'", c.Val())
 		}

plugin/https/setup_test.go

@@ -2,6 +2,7 @@ package https
 
 import (
 	"fmt"
+	"strconv"
 	"strings"
 	"testing"
 
@@ -10,11 +11,27 @@ import (
 )
 
 func TestSetup(t *testing.T) {
+	// The uint32 upper-bound boundary is architecture-dependent. On 64-bit int,
+	// 4294967295 is accepted and 4294967296 hits the "must not exceed" guard. On
+	// 32-bit int, both overflow and Atoi rejects them as "invalid max_streams"
+	// first. Derive the value via Atoi (never a constant literal) so the source
+	// stays portable to 32-bit targets.
+	maxUint32Err, maxUint32ErrContent := false, ""
+	var maxUint32Streams *int
+	overMaxUint32ErrContent := "must not exceed"
+	if v, err := strconv.Atoi("4294967295"); err == nil {
+		maxUint32Streams = &v
+	} else {
+		maxUint32Err, maxUint32ErrContent = true, "invalid max_streams value"
+		overMaxUint32ErrContent = "invalid max_streams value"
+	}
+
 	tests := []struct {
 		input                  string
 		shouldErr              bool
 		expectedErrContent     string
 		expectedMaxConnections *int
+		expectedMaxStreams     *int
 	}{
 		// Valid configurations
 		{
@@ -33,6 +50,22 @@ func TestSetup(t *testing.T) {
 			shouldErr:              false,
 			expectedMaxConnections: intPtr(200),
 		},
+		{
+			input: `https {
+				max_streams 100
+			}`,
+			shouldErr:          false,
+			expectedMaxStreams: intPtr(100),
+		},
+		{
+			input: `https {
+				max_connections 200
+				max_streams 100
+			}`,
+			shouldErr:              false,
+			expectedMaxConnections: intPtr(200),
+			expectedMaxStreams:     intPtr(100),
+		},
 		// Zero values (unbounded)
 		{
 			input: `https {
@@ -71,6 +104,57 @@ func TestSetup(t *testing.T) {
 			shouldErr:          true,
 			expectedErrContent: "already defined",
 		},
+		{
+			input: `https {
+				max_streams
+			}`,
+			shouldErr:          true,
+			expectedErrContent: "Wrong argument count",
+		},
+		{
+			input: `https {
+				max_streams abc
+			}`,
+			shouldErr:          true,
+			expectedErrContent: "invalid max_streams value",
+		},
+		{
+			input: `https {
+				max_streams 0
+			}`,
+			shouldErr:          false,
+			expectedMaxStreams: intPtr(0),
+		},
+		{
+			input: `https {
+				max_streams -1
+			}`,
+			shouldErr:          true,
+			expectedErrContent: "must be a non-negative integer",
+		},
+		{
+			input: `https {
+				max_streams 4294967295
+			}`,
+			shouldErr:          maxUint32Err,
+			expectedErrContent: maxUint32ErrContent,
+			expectedMaxStreams: maxUint32Streams,
+		},
+		{
+			input: `https {
+				max_streams 4294967296
+			}`,
+			shouldErr:          true,
+			expectedErrContent: overMaxUint32ErrContent,
+		},
+		{
+			input: `https {
+				max_streams 100
+				max_streams 200
+			}`,
+			shouldErr:          true,
+			expectedErrContent: "already defined",
+		},
 		{
 			input: `https {
 				unknown_option 123
@@ -110,6 +194,7 @@ func TestSetup(t *testing.T) {
 		if !test.shouldErr {
 			config := dnsserver.GetConfig(c)
 			assertIntPtrValue(t, i, test.input, "MaxHTTPSConnections", config.MaxHTTPSConnections, test.expectedMaxConnections)
+			assertIntPtrValue(t, i, test.input, "MaxHTTPSStreams", config.MaxHTTPSStreams, test.expectedMaxStreams)
 		}
 	}
 }