Use client setting for max_frame size

[shinrich]

It appears that currently the major browsers do not set the max frame size in the settings, but it seems that we should take them up on larger frame sizes if they are willing to handle them.

[shinrich]

[approve ci clang-analyzer]

[shinrich]

[approve ci clang-format]

[masaori335]

Nice catch. This is what we're missing. Does this improve performance when client set the setting?
Also, I'm wondering if we should use the value from the client naively. When the client says 2^24-1 (the maximum value), do we really allow to create 16MB data frame?

SETTINGS_MAX_FRAME_SIZE (0x5): Indicates the size of the largest
frame payload that the sender is willing to receive, in octets.

 The initial value is 2^14 (16,384) octets.  The value advertised
 by an endpoint MUST be between this initial value and the maximum
 allowed frame size (2^24-1 or 16,777,215 octets), inclusive.
 Values outside this range MUST be treated as a connection error
 (Section 5.4.1) of type PROTOCOL_ERROR.

[zwoop]

@masaori335 @shinrich It seems your comments / concerns around unfiltered use of this settings was ignored? Are we ok with this-as is? Is there a DOS attack vector here ? If so, how would we address this, another records.config setting with a max-cap that we allow ?

[masaori335]

When malicious client set 16MB, ATS easily get a stack overflow. (proxy.config.thread.default.stacksize is 1MB ) We need a setting to control the buffer size, I think.
@shinrich Am I missing something?

---

UPDATE: The buffer I'm worrying about is in line 1485

trafficserver/proxy/http2/Http2ConnectionState.cc

Line 1485 in 473e054

uint8_t payload_buffer[buf_len];

[masaori335]

I have a security concern commented above.

[zwoop]

Moving out to 9.1.x

[shinrich]

Agreed if we take their value, we should have another max possible setting to limit how much we are willing to open things up.

[shinrich]

Closing this for now. Sounds like we need to take a more nuanced approach

[maskit]

Since #6337 removed the concerning buffer, maybe we can do this now?