Receiving a PUSH_PROMISE from a client is an error

HISTORY.rst

@@ -56,6 +56,8 @@ Bugfixes
   7540 Section 8.1.2.1.
 - Correctly refuse to send trailers that contain HTTP/2 pseudo-header fields,
   per RFC 7540 Section 8.1.2.1.
+- Correctly reject a PUSH_PROMISE frame sent by a client, per RFC 7540
+  Section 8.2.
 
 
 2.4.0 (2016-07-01)

h2/connection.py

@@ -1487,6 +1487,10 @@ def _receive_push_promise_frame(self, frame):
         """
         Receive a push-promise frame on the connection.
         """
+        # A client cannot push - RFC 7540 § 8.2
+        if not self.config.client_side:
+            raise ProtocolError("Received pushed stream from a client")
+
         if not self.local_settings.enable_push:
             raise ProtocolError("Received pushed stream")
 

test/test_basic_logic.py

@@ -1523,3 +1523,33 @@ def test_receiving_goaway_frame_with_unknown_error(self, frame_factory):
         assert c.state_machine.state == h2.connection.ConnectionState.CLOSED
 
         assert not c.data_to_send()
+
+    def test_receiving_push_promise_from_client_is_error(self, frame_factory):
+        """
+        If we are a server, receiving PUSH_PROMISE frames from a client
+        causes the connection to be closed.
+        """
+        c = h2.connection.H2Connection(client_side=False)
+        c.initiate_connection()
+        c.receive_data(frame_factory.preamble())
+
+        f1 = frame_factory.build_headers_frame(
+            self.example_request_headers
+        )
+        f2 = frame_factory.build_push_promise_frame(
+            stream_id=1,
+            promised_stream_id=2,
+            headers=self.example_request_headers,
+            flags=['END_HEADERS'],
+        )
+        c.receive_data(f1.serialize())
+        c.clear_outbound_data_buffer()
+
+        with pytest.raises(h2.exceptions.ProtocolError) as excinfo:
+            c.receive_data(f2.serialize())
+        excinfo.match('Received pushed stream from a client')
+
+        expected_frame = frame_factory.build_goaway_frame(
+            1, h2.errors.ErrorCodes.PROTOCOL_ERROR
+        )
+        assert c.data_to_send() == expected_frame.serialize()