From: Willy Tarreau <w@1wt.eu>
Date: Thu, 19 Mar 2026 06:11:54 +0000 (+0100)
Subject: BUG/MINOR: mux-h2: properly ignore R bit in GOAWAY stream ID
X-Git-Tag: v3.4-dev7~14
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0e231bbd7ca7b3f35c1358ef9145280db90a96b6;p=thirdparty%2Fhaproxy.git

BUG/MINOR: mux-h2: properly ignore R bit in GOAWAY stream ID

The stream ID indicated in GOAWAY frames must have its bit 31 (R) ignored
and this wasn't the case. The effect is that if this bit was present, the
GOAWAY frame would mark the last acceptable stream as negative, which is
the default situation (unlimited), thus would basically result in this
GOAWAY frame to be ignored since it would replace a negative last_sid
with another negative one. The impact is thus basically that if a peer
would emit anything non-zero in the R bit, the GOAWAY frame would be
ignored and new streams would still be initiated on the backend, before
being rejected by the server.

Thanks to Haruto Kimura (Stella) for finding and reporting this bug.

This fix needs to be backported to all stable versions.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index bfb02aa1d..09606ca39 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -3384,7 +3384,7 @@ static int h2c_handle_goaway(struct h2c *h2c)
 		return 0;
 	}
 
-	last = h2_get_n32(&h2c->dbuf, 0);
+	last = h2_get_n32(&h2c->dbuf, 0) & 0x7FFFFFFF; // mask R bit
 	h2c->errcode = h2_get_n32(&h2c->dbuf, 4);
 	if (h2c->last_sid < 0)
 		h2c->last_sid = last;