BUG/MEDIUM: mux-h1: Skip UNUSED htx block when formating the start line

UNUSED blocks were not properly handled when the H1 multiplexer was
formatting the start line of a request or a response. UNUSED was ignored but
not removed from HTX message. So the mux can loop infinitly on such block.

It could be seen a a major issue but in fact it happens only if a very
specific case on the reponse processing (at least I think so): the server
must send an interim message (a 100-continue for intance) with the final
response. HAProxy must receive both in same time and the final reponse must
be intercepted (via a http-response return action for instance), In that
case, the interim message is fowarded and the server final reponse is
removed and replaced by a proxy error message.

Now UNUSED htx blocks are properly skipped and removed.

This patch must be backported as far as 3.0.

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 3d88ad8b187bb849f63a1cbcbf367eb77289a5ba..232c9c18447c6214835b55a5fe05b3a2b2725a10 100644 (file)
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -2488,8 +2488,10 @@ static size_t h1_make_reqline(struct h1s *h1s, struct h1m *h1m, struct htx *htx,
                        goto end;
                type = htx_get_blk_type(blk);
                sz = htx_get_blksz(blk);
-               if (type == HTX_BLK_UNUSED)
+               if (type == HTX_BLK_UNUSED) {
+                       htx_remove_blk(htx, blk);
                        continue;
+               }
                if (type != HTX_BLK_REQ_SL || sz > count)
                        goto error;
                break;
@@ -2577,8 +2579,10 @@ static size_t h1_make_stline(struct h1s *h1s, struct h1m *h1m, struct htx *htx,
                type = htx_get_blk_type(blk);
                sz = htx_get_blksz(blk);
 
-               if (type == HTX_BLK_UNUSED)
+               if (type == HTX_BLK_UNUSED) {
+                       htx_remove_blk(htx, blk);
                        continue;
+               }
                if (type != HTX_BLK_RES_SL || sz > count)
                        goto error;
                break;