net.http: honor peer SETTINGS_MAX_HEADER_LIST_SIZE on requests (RFC 9113 §6.5.2)

The sync and server paths recorded the peer advisory
SETTINGS_MAX_HEADER_LIST_SIZE but neither client path enforced it, and the
mux path did not even store it (apply_peer_settings had no arm for it, so it
was silently ignored). A request whose header list exceeded the server limit
was emitted and rejected only after the round trip.

Store the setting on the mux path (new wmu-guarded field + apply_peer_settings
arm, matching the sync/server paths) and, on both client paths, compute the
§6.5.2 header-list size (sum of name+value+32 per field) before encoding and
refuse an over-limit request locally with a non-retryable error (a fresh
connection to the same peer carries the same limit). Default is unlimited, so
behavior is unchanged unless the peer sets a limit. Adds tests on both paths.

Co-Authored-By: WOZCODE <contact@withwoz.com>

Author: quaesitor-scientiam

vlib/net/http/h2_conn.v

@@ -151,6 +151,15 @@ pub fn (mut c H2Conn) do(req H2ClientRequest) !H2ClientResponse {
 	for h in req.headers {
 		fields << h
 	}
+	// RFC 9113 §6.5.2: honor the peer's advisory SETTINGS_MAX_HEADER_LIST_SIZE —
+	// refuse an over-limit request locally instead of having the server reject it
+	// after the round trip.
+	if c.peer.max_header_list_size != max_u32 {
+		size := h2_header_list_size(fields)
+		if size > u64(c.peer.max_header_list_size) {
+			return error('h2: request header list (${size} bytes) exceeds peer SETTINGS_MAX_HEADER_LIST_SIZE (${c.peer.max_header_list_size})')
+		}
+	}
 	block := c.encoder.encode(fields)
 	has_body := req.body.len > 0
 	c.send_header_block(stream_id, block, !has_body)!

vlib/net/http/h2_conn_test.v

@@ -576,3 +576,25 @@ fn test_h2_conn_rejects_malformed_response_fields() {
 		assert err.msg().contains('uppercase'), 'unexpected error: ${err.msg()}'
 	}
 }
+
+// RFC 9113 §6.5.2: the client honors the peer's advisory
+// SETTINGS_MAX_HEADER_LIST_SIZE and refuses an over-limit request rather than
+// emitting it. Conformance gap G4 (set white-box: on the sync path the peer's
+// SETTINGS arrive only with the response, after the request is built).
+fn test_h2_conn_respects_peer_max_header_list_size() {
+	mut c := new_h2_conn(&MockTransport{
+		inbound: build_server_stream([H2HeaderField{':status', '200'}], [])
+	})
+	c.peer.max_header_list_size = 40 // tiny: even the pseudo-headers exceed it
+	if _ := c.do(H2ClientRequest{
+		method:    'GET'
+		scheme:    'https'
+		authority: 'example.com'
+		path:      '/a-fairly-long-path-to-exceed-the-limit'
+	})
+	{
+		assert false, 'over-limit request was sent'
+	} else {
+		assert err.msg().contains('MAX_HEADER_LIST_SIZE'), 'unexpected error: ${err.msg()}'
+	}
+}

vlib/net/http/h2_mux_conn.v

@@ -97,6 +97,17 @@ fn h2_response_field_error(name string) string {
 	return ''
 }
 
+// h2_header_list_size returns the RFC 9113 §6.5.2 size of a header list: the sum
+// over all fields of (name length + value length + 32 octets of per-field
+// overhead). Used to honor the peer's advisory SETTINGS_MAX_HEADER_LIST_SIZE.
+fn h2_header_list_size(fields []H2HeaderField) u64 {
+	mut total := u64(0)
+	for f in fields {
+		total += u64(f.name.len) + u64(f.value.len) + 32
+	}
+	return total
+}
+
 // H2MuxStream is the client-side state of one in-flight request stream.
 @[heap]
 struct H2MuxStream {
@@ -157,12 +168,13 @@ mut:
 	// panics on a nil closer.
 	close_transport fn () = unsafe { nil }
 	// --- guarded by wmu ---
-	wmu                   &sync.Mutex = sync.new_mutex()
-	encoder               H2HpackEncoder
-	next_stream_id        u32 = 1
-	handshaked            bool
-	pending_settings_acks int    // count of SETTINGS frames received before our preface; each needs one ACK
-	pending_ping_acks     [][]u8 // PING frames received before our preface; each needs an ACK with the same data
+	wmu                       &sync.Mutex = sync.new_mutex()
+	encoder                   H2HpackEncoder
+	next_stream_id            u32 = 1
+	handshaked                bool
+	pending_settings_acks     int    // count of SETTINGS frames received before our preface; each needs one ACK
+	pending_ping_acks         [][]u8 // PING frames received before our preface; each needs an ACK with the same data
+	peer_max_header_list_size u32 = max_u32 // peer SETTINGS_MAX_HEADER_LIST_SIZE (advisory, §6.5.2)
 	// --- guarded by fmu, fcv signals growth/death ---
 	fmu                 &sync.Mutex = unsafe { nil }
 	fcv                 &sync.Cond  = unsafe { nil }
@@ -379,6 +391,15 @@ fn (mut c H2MuxConn) do_on_stream(mut s H2MuxStream, req H2ClientRequest) !H2Cli
 		c.note_write_failure()
 		return h2_retryable_error('connection handshake failed: ${err.msg()}')
 	}
+	// RFC 9113 §6.5.2: honor the peer's advisory SETTINGS_MAX_HEADER_LIST_SIZE.
+	// Refuse an over-limit request here rather than emit it and have the server
+	// reject it (e.g. 431). Not retryable: a fresh connection to the same peer
+	// carries the same limit. Read under wmu (apply_peer_settings sets it there).
+	peer_max_list := c.peer_max_header_list_size
+	if peer_max_list != max_u32 && h2_header_list_size(fields) > u64(peer_max_list) {
+		c.wmu.unlock()
+		return error('h2: request header list (${h2_header_list_size(fields)} bytes) exceeds peer SETTINGS_MAX_HEADER_LIST_SIZE (${peer_max_list})')
+	}
 	if c.next_stream_id > u32(0x7fff_ffff) {
 		// RFC 7540 §5.1.1: client stream IDs are odd and must not exceed 2^31-1.
 		// Retire this connection and let the caller open a fresh one.
@@ -1205,6 +1226,15 @@ fn (mut c H2MuxConn) apply_peer_settings(settings []H2Setting) ! {
 				c.peer_max_streams = st.value
 				c.smu.unlock()
 			}
+			h2_settings_max_header_list_size {
+				// RFC 9113 §6.5.2: advisory cap on the size of the header list we
+				// send. Store it (under wmu, with the other send-side header state)
+				// so do_on_stream can refuse an over-limit request locally instead
+				// of having the server reject it after the round trip.
+				c.wmu.lock()
+				c.peer_max_header_list_size = st.value
+				c.wmu.unlock()
+			}
 			h2_settings_initial_window_size {
 				if st.value > u32(0x7fff_ffff) {
 					// RFC 7540 6.5.3: values above 2^31-1 are a FLOW_CONTROL_ERROR;

vlib/net/http/h2_mux_conn_test.v

@@ -2082,3 +2082,42 @@ fn test_mux_trailers_reject_pseudo() {
 	assert peer.failure_msg() == ''
 	assert got.contains('malformed trailers'), 'trailers pseudo-header not rejected: ${got}'
 }
+
+// RFC 9113 §6.5.2: the client honors the peer's advisory
+// SETTINGS_MAX_HEADER_LIST_SIZE and refuses an over-limit request locally rather
+// than emitting it. Conformance gap G4. The peer sends no SETTINGS here, so the
+// reader never writes peer_max_header_list_size — setting it directly before the
+// request is race-free.
+fn test_mux_request_respects_peer_max_header_list_size() {
+	mut cend, mut pend := new_mux_pipe()
+	mut conn := new_test_mux_conn(mut cend)
+	conn.peer_max_header_list_size = 40 // tiny: even the pseudo-headers exceed it
+	mut peer := &MuxTestPeer{
+		end: pend
+	}
+	peer_thread := spawn fn (mut peer MuxTestPeer) {
+		peer.read_preface() or {
+			peer.fail('preface: ${err.msg()}')
+			return
+		}
+		for {
+			peer.pump() or { return }
+		}
+	}(mut peer)
+	mut got := ''
+	if _ := conn.do(H2ClientRequest{
+		method:    'GET'
+		scheme:    'https'
+		authority: 'example.com'
+		path:      '/a-fairly-long-path-to-exceed-the-limit'
+	})
+	{
+		got = '<<accepted>>'
+	} else {
+		got = err.msg()
+	}
+	cend.close_both()
+	peer_thread.wait()
+	assert peer.failure_msg() == ''
+	assert got.contains('MAX_HEADER_LIST_SIZE'), 'over-limit request not rejected: ${got}'
+}