From: Willy Tarreau <w@1wt.eu>
Date: Thu, 17 Jun 2021 06:08:48 +0000 (+0200)
Subject: MINOR: mux-h2: obey http-ignore-probes during the preface
X-Git-Tag: v2.5-dev1~103
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ee4684f65b6ea627e34395d254daf7971d3ed90f;p=thirdparty%2Fhaproxy.git

MINOR: mux-h2: obey http-ignore-probes during the preface

We're seeing some browsers setting up multiple connections and closing
some to just keep one. It looks like they do this in case they'd
negotiate H1. This results in aborted prefaces and log pollution about
bad requests and "PR--" in the status flags.

We already have an option to ignore connections with no data, it's called
http-ignore-probes. But it was not used by the H2 mux. However it totally
makes sense to use it during the preface.

This patch changes this so that connections aborted before sending the
preface can avoid being logged.

This should be backported to 2.4 and 2.3 at least, and probably even
as far as 2.0.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index dfd437e700..1150660b9c 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -1701,7 +1701,9 @@ static int h2c_frt_recv_preface(struct h2c *h2c)
 		if (ret1 < 0 || conn_xprt_read0_pending(h2c->conn)) {
 			TRACE_ERROR("I/O error or short read", H2_EV_RX_FRAME|H2_EV_RX_PREFACE, h2c->conn);
 			h2c_error(h2c, H2_ERR_PROTOCOL_ERROR);
-			HA_ATOMIC_INC(&h2c->px_counters->conn_proto_err);
+			if (b_data(&h2c->dbuf) ||
+			    !(((const struct session *)h2c->conn->owner)->fe->options & PR_O_IGNORE_PRB))
+				HA_ATOMIC_INC(&h2c->px_counters->conn_proto_err);
 		}
 		ret2 = 0;
 		goto out;
@@ -3128,7 +3130,9 @@ static void h2_process_demux(struct h2c *h2c)
 				if (h2c->st0 == H2_CS_ERROR) {
 					TRACE_PROTO("failed to receive preface", H2_EV_RX_PREFACE|H2_EV_PROTO_ERR, h2c->conn);
 					h2c->st0 = H2_CS_ERROR2;
-					sess_log(h2c->conn->owner);
+					if (b_data(&h2c->dbuf) ||
+					    !(((const struct session *)h2c->conn->owner)->fe->options & PR_O_IGNORE_PRB))
+						sess_log(h2c->conn->owner);
 				}
 				goto fail;
 			}