From: Willy Tarreau <w@1wt.eu>
Date: Wed, 30 Jan 2019 15:55:48 +0000 (+0100)
Subject: BUG/MINOR: mux-h2: make sure response HEADERS are not received in other states than... 
X-Git-Tag: v2.0-dev1~108
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=08bb1d61099e7f12aea17a03c608e51002442ed7;p=thirdparty%2Fhaproxy.git

BUG/MINOR: mux-h2: make sure response HEADERS are not received in other states than OPEN and HLOC

RFC7540#5.1 states that these are the only states allowing any frame
type. For response HEADERS frames, we cannot accept that they are
delivered on idle streams of course, so we're left with these two
states only. It is important to test this so that we can remove the
generic CLOSE_STREAM test for such frames in the main loop.

This must be backported to 1.9 (1.8 doesn't have response HEADERS).
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index badd905d10..c216f5032e 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -2039,6 +2039,13 @@ static struct h2s *h2c_bck_handle_headers(struct h2c *h2c, struct h2s *h2s)
 	if (h2c->st0 >= H2_CS_ERROR)
 		return NULL;
 
+	if (h2s->st != H2_SS_OPEN && h2s->st != H2_SS_HLOC) {
+		/* RFC7540#5.1 */
+		h2s_error(h2s, H2_ERR_STREAM_CLOSED);
+		h2c->st0 = H2_CS_FRAME_E;
+		return NULL;
+	}
+
 	if (error <= 0) {
 		if (error == 0)
 			return NULL; // missing data