From: Willy Tarreau <w@1wt.eu>
Date: Fri, 1 Feb 2019 14:51:59 +0000 (+0100)
Subject: BUG/MEDIUM: mux-h2: always omit :scheme and :path for the CONNECT method
X-Git-Tag: v2.0-dev1~78
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5be92ff23f7494902091b1bf76d7787ec3fbf706;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-h2: always omit :scheme and :path for the CONNECT method

This is mandated by RFC7540 #8.3, these pseudo-headers must not be emitted
with the CONNECT method.

This must be backported to 1.9.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 5fdaadf500..1c6f3d2099 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -4425,20 +4425,27 @@ static size_t h2s_htx_bck_make_req_headers(struct h2s *h2s, struct htx *htx)
 		goto full;
 	}
 
-	/* encode the scheme which is always "https" (or 0x86 for "http") */
-	if (!hpack_encode_scheme(&outbuf, ist("https"))) {
-		/* output full */
-		if (b_space_wraps(&h2c->mbuf))
-			goto realign_again;
-		goto full;
-	}
+	/* RFC7540 #8.3: the CONNECT method must have :
+	 *   - :authority set to the URI part (host:port)
+	 *   - :method set to CONNECT
+	 *   - :scheme and :path omitted
+	 */
+	if (sl->info.req.meth != HTTP_METH_CONNECT) {
+		/* encode the scheme which is always "https" (or 0x86 for "http") */
+		if (!hpack_encode_scheme(&outbuf, ist("https"))) {
+			/* output full */
+			if (b_space_wraps(&h2c->mbuf))
+				goto realign_again;
+			goto full;
+		}
 
-	/* encode the path, which necessarily is the second one */
-	if (!hpack_encode_path(&outbuf, path)) {
-		/* output full */
-		if (b_space_wraps(&h2c->mbuf))
-			goto realign_again;
-		goto full;
+		/* encode the path, which necessarily is the second one */
+		if (!hpack_encode_path(&outbuf, path)) {
+			/* output full */
+			if (b_space_wraps(&h2c->mbuf))
+				goto realign_again;
+			goto full;
+		}
 	}
 
 	/* encode all headers, stop at empty name */