Pass 1/4 audit follow-up — three of the four deferred items are already covered by 5261dbe ("fix(h2-parser): harden GOAWAY length, strip_padding bounds, unknown frame, and PUSH_PROMISE"): 1. GOAWAY payload_len < 8 → parser.rs:381-389 (5261dbe) 2. strip_padding off-by-one → parser.rs:427-447 (5261dbe) 3. Unknown frame types (RFC §5.5) → parser.rs:794-804 (5261dbe) The fourth item — stream-ID exhaustion on an H2 connection — was already wired client-side by FIX-22 (h2.rs:4778-4804 calls graceful_goaway() on a None return from new_stream_id()), but (a) the allocator had no unit test, and (b) the guard carried an off-by-one: `next > STREAM_ID_MAX` wrongly rejected the valid final-slot allocation whose issued identifier equals STREAM_ID_MAX. Two stream IDs out of 2³¹ — cosmetic but surprising, and the kind of thing that hides real bugs behind it. Changes: - Extract the allocator into a pure free function `next_stream_id(last_stream_id, is_client) -> Option<(StreamId, StreamId)>` so it is unit-testable without building a full ConnectionH2 fixture (mio socket + pool + timer). ConnectionH2::new_stream_id now delegates. - Tighten the exhaustion guard to check the *issued* identifier, not the post-call watermark. The watermark is allowed to sit at STREAM_ID_MAX+1 (sentinel that makes the next call fail); only an issued ID greater than STREAM_ID_MAX is rejected. Also use checked_sub on both branches for defence in depth. - Add 9 unit tests covering: fresh client allocation, odd-parity monotonic sequence, server even-parity symmetry (Sozu never server-pushes but the helper is kept symmetric), final-slot allocation, exhaustion on both sides, checked_add saturation near u32::MAX, a neighbourhood sweep of ±4 around STREAM_ID_MAX that guarantees no issued ID ever exceeds the bound, and client/server parity disjointness at common watermarks. - Record the verification in tasks/audit-verify-findings.md for the audit trail (each item with verdict + evidence + action taken). Validation: - cargo build --all-features --locked - cargo clippy --all-targets --locked (only the pre-existing if_same_then_else in h2_correctness_tests.rs:504, documented in CLAUDE.md) - cargo +nightly fmt --all -- --check - cargo test -p sozu-lib --locked --lib tests::test_next_stream_id (9/9) - cargo test --workspace --locked --lib -- parser (64/64) - cargo test -p sozu-e2e --locked -- h2_security_parser h2_security_session (13/13 + 1 ignored FIX-22 smoke now covered by unit tests above) - cargo +nightly fuzz run fuzz_frame_parser -max_total_time=60 (1_536_093 execs, 25_181 exec/s, cov 327, no crashes) Refs: FIX-22, Pass 1 Medium #3/4/5, Pass 4 Medium #5. Signed-off-by: Florentin Dubois <florentin.dubois@clever-cloud.com> Signed-off-by: Florentin Dubois <florentin.dubois@clever.cloud>

Remove unused SERVER constant from TcpProxy #3

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions