]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MEDIUM: mux-spop: Properly detect truncated frames on demux to report error
authorChristopher Faulet <cfaulet@haproxy.com>
Wed, 14 May 2025 07:22:45 +0000 (09:22 +0200)
committerChristopher Faulet <cfaulet@haproxy.com>
Wed, 14 May 2025 09:47:41 +0000 (11:47 +0200)
There was no test in the demux part to detect truncated frames and to report
an error at the connection level. The SPOP streams were properly switch to
half-closed state. But waiting the associated SPOE applets were woken up and
released, the SPOP connection could be woken up several times for nothing. I
never triggered the watchdog in that case, but it is not excluded.

Now, at the end of the demux function, if a specific test was added to
detect truncated frames to report an error and close the connection.

This patch must be backported to 3.1.

src/mux_spop.c

index 2a5002d99dd1b2862bb5bcd9a7cdb15a431b9e37..7b00087c79184a5cd70e44d7ba389ca2f1abe9e9 100644 (file)
@@ -2272,6 +2272,13 @@ static void spop_process_demux(struct spop_conn *spop_conn)
                        spop_conn->flags |= SPOP_CF_END_REACHED;
        }
 
+       if (spop_conn_read0_pending(spop_conn) && (spop_conn->flags & SPOP_CF_DEM_SHORT_READ) && b_data(&spop_conn->dbuf)) {
+               spop_conn_error(spop_conn, SPOP_ERR_INVALID);
+               spop_conn->state = SPOP_CS_CLOSED;
+               TRACE_ERROR("truncated data", SPOP_EV_RX_FRAME|SPOP_EV_RX_FHDR|SPOP_EV_SPOP_CONN_ERR, spop_conn->conn);
+               TRACE_STATE("switching to CLOSED", SPOP_EV_RX_FRAME|SPOP_EV_RX_FHDR|SPOP_EV_SPOP_CONN_ERR, spop_conn->conn);
+       }
+
        if (spop_conn->flags & SPOP_CF_ERROR)
                spop_conn_report_term_evt(spop_conn, ((eb_is_empty(&spop_conn->streams_by_id) && (spop_conn->state == SPOP_CS_RUNNING) && spop_conn->dsi == -1)
                                                      ? muxc_tevt_type_rcv_err