BUG/MEDIUM: mux-h1: Stop sending vi fast-forward for unexpected states

If a producer tries to send data via the fast-forward mechanism while the
message is in an unexpected state from the consumer point of view, the
fast-forward is now disabled. Concretely, we now take care that the message
is in its data/tunnel stage to proceed in h1_nego_ff().

By disabling fast-forward in that case, we will automatically fall back on
the regular sending path and be able to handle the error in h1_snd_buf().

This patch should be backported as far as 3.0

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 232c9c18447c6214835b55a5fe05b3a2b2725a10..81bd071bace06bd01bdc42ac561d3b8debfc3cb6 100644 (file)
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -4937,6 +4937,12 @@ static size_t h1_nego_ff(struct stconn *sc, struct buffer *input, size_t count,
                goto out;
        }
 
+       if (h1m->state < H1_MSG_CHUNK_SIZE || h1m->state == H1_MSG_TRAILERS || h1m->state == H1_MSG_DONE) {
+               TRACE_STATE("Unexpected message state, disable fastfwd", H1_EV_STRM_SEND|H1_EV_STRM_ERR, h1c->conn, h1s);
+               h1s->sd->iobuf.flags |= IOBUF_FL_NO_FF;
+               goto out;
+       }
+
        if ((!(h1m->flags & H1_MF_RESP) && (h1s->flags & H1S_F_BODYLESS_REQ)) ||
            ((h1m->flags & H1_MF_RESP) && (h1s->flags & H1S_F_BODYLESS_RESP))) {
                TRACE_STATE("Bodyless message, disable fastfwd", H1_EV_STRM_SEND|H1_EV_STRM_ERR, h1c->conn, h1s);