blackbull.fault_injection.catalogue.h2_client

blackbull.fault_injection.catalogue.h2_client

Named HTTP/2 client-side misbehaviour cases.

Each entry is one thing a real client does wrong to a server, named so a suite can parametrize over the set and report which case broke it.

The HTTP/2 rows of the attack-surface audit are what this set is drawn from, so the names line up with the defences on the other side: if rapid_reset_burst stops failing, the meter that answers it changed.

abort_mid_header_block()

Open a header block, then RST the transport rather than the stream.

data_frame_lies_about_length()

A frame header declaring 100 payload bytes, carrying 2.

empty_continuation_flood()

CVE-2024-27983 shape — a header block extended by zero-length frames.

No byte budget can see these: they add nothing to the block, so the defence has to count them.

header_block_never_finished()

HEADERS without END_HEADERS, then silence.

HPACK state is connection-wide, so the server cannot abandon this per-stream — the reason its answer is a connection error.

ping_flood()

CVE-2019-9512 — every PING obliges an ACK write, at no byte cost.

preface_never_arrives()

Connect, send nothing, hold the connection open.

What BB_HEADER_TIMEOUT and the connection-detect deadline answer.

preface_trickled()

The preface, one byte every 100 ms — legal bytes, hostile pacing.

rapid_reset_burst()

CVE-2023-44487 — open streams and reset them immediately.

Each HEADERS costs the server a stream; each RST_STREAM frees it before SETTINGS_MAX_CONCURRENT_STREAMS ever bites, so the cost is unbounded without a rate meter.

settings_ack_with_payload()

§6.5 — a SETTINGS frame with ACK set MUST have an empty payload.

settings_flood()

CVE-2019-9515 — same shape, SETTINGS instead of PING.

unknown_frame_type()

RFC 9113 §4.1 — an unregistered type MUST be ignored, not fatal.