From: Christopher Faulet <cfaulet@haproxy.com>
Date: Mon, 4 Oct 2021 05:50:13 +0000 (+0200)
Subject: BUG/MEDIUM: filters: Fix a typo when a filter is attached blocking the release
X-Git-Tag: v2.5-dev9~123
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d28b2b2352291991190fd0693fdfd3d7430e6ddb;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: filters: Fix a typo when a filter is attached blocking the release

When a filter is attached to a stream, the wrong FLT_END analyzer is added
on the request channel. AN_REQ_FLT_END must be added instead of
AN_RES_FLT_END. Because of this bug, the stream may hang on the filter
release stage.

It seems to be ok for HTTP filters (cache & compression) in HTTP mode. But
when enabled on a TCP proxy, the stream is blocked until the client or the
server timeout expire because data forwarding is blocked. The stream is then
prematurely aborted.

This bug was introduced by commit 26eb5ea35 ("BUG/MINOR: filters: Always set
FLT_END analyser when CF_FLT_ANALYZE flag is set"). The patch must be
backported in all stable versions.
---

diff --git a/reg-tests/filters/random-forwarding.vtc b/reg-tests/filters/random-forwarding.vtc
index 07dd2b85ce..650d207e15 100644
--- a/reg-tests/filters/random-forwarding.vtc
+++ b/reg-tests/filters/random-forwarding.vtc
@@ -37,6 +37,16 @@ server s1 {
         rxreq
         expect req.url == "/"
         txresp -nolen
+        close
+
+        accept
+        rxreq
+        expect req.url == "/"
+        expect req.bodylen == 20480
+        txresp -nolen \
+          -hdr "Content-Type: text/plain" \
+          -bodylen 20480
+
 } -start
 
 haproxy h1 -conf {
@@ -60,6 +70,14 @@ haproxy h1 -conf {
     backend be1
         server www ${s1_addr}:${s1_port}
 
+    listen li1
+        mode tcp
+        bind "fd@${li1}"
+        # Validate nothing is blocked in TCP mode
+        filter compression
+        server www ${s1_addr}:${s1_port}
+
+
 } -start
 
 client c1 -connect ${h1_fe1_sock} {
@@ -105,3 +123,17 @@ client c3 -connect ${h1_fe1_sock} {
         expect resp.http.content-length == "<undef>"
         expect resp.bodylen == 0
 } -run
+
+client c4 -connect ${h1_li1_sock} {
+        txreq -url "/" \
+          -hdr "Accept-Encoding: gzip" \
+          -hdr "Content-Type: text/plain" \
+          -bodylen 20480
+        rxresp
+        expect resp.status == 200
+        expect resp.http.content-encoding == "<undef>"
+        expect resp.http.transfer-encoding == "<undef>"
+        expect resp.http.content-length == "<undef>"
+        expect resp.bodylen == 20480
+        expect_close
+} -run
diff --git a/src/filters.c b/src/filters.c
index 136a3e80b3..f64c192bdb 100644
--- a/src/filters.c
+++ b/src/filters.c
@@ -475,7 +475,7 @@ flt_stream_start(struct stream *s)
 	}
 	if (strm_li(s) && (strm_li(s)->analysers & AN_REQ_FLT_START_FE)) {
 		s->req.flags |= CF_FLT_ANALYZE;
-		s->req.analysers |= AN_RES_FLT_END;
+		s->req.analysers |= AN_REQ_FLT_END;
 	}
 	return 0;
 }