From: Christopher Faulet <cfaulet@haproxy.com>
Date: Mon, 16 Nov 2020 09:10:38 +0000 (+0100)
Subject: BUG/MEDIUM: filters: Forward all filtered data at the end of http filtering
X-Git-Tag: v2.4-dev1~41
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=22fca1f2c;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: filters: Forward all filtered data at the end of http filtering

When http filtering ends, if there are some filtered data not forwarded yet, we
forward them, in flt_http_end(). Most of time, this doesn't happen, except when
a tunnel is established using a CONNECT. In this case, there is not EOM on the
request and there is no body. Thus the headers are never forwarded, blocking the
stream.

This patch must be backported as far as 2.0. Prior versions don't suffer of this
bug because there is no HTX support. On the 2.0, the change is only applicable
on HTX streams. A special test must be performed to make sure.
---

diff --git a/src/filters.c b/src/filters.c
index 1b954d87d0..eddfb70d2c 100644
--- a/src/filters.c
+++ b/src/filters.c
@@ -546,10 +546,15 @@ flt_set_stream_backend(struct stream *s, struct proxy *be)
 int
 flt_http_end(struct stream *s, struct http_msg *msg)
 {
+	unsigned long long *strm_off = &FLT_STRM_OFF(s, msg->chn);
+	unsigned int offset = 0;
 	int ret = 1;
 
 	DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_HTTP_ANA|STRM_EV_FLT_ANA, s, s->txn, msg);
 	RESUME_FILTER_LOOP(s, msg->chn) {
+		unsigned long long flt_off = FLT_OFF(filter, msg->chn);
+		offset = flt_off - *strm_off;
+
 		if (FLT_OPS(filter)->http_end) {
 			DBG_TRACE_DEVEL(FLT_ID(filter), STRM_EV_HTTP_ANA|STRM_EV_FLT_ANA, s);
 			ret = FLT_OPS(filter)->http_end(s, filter, msg);
@@ -557,6 +562,10 @@ flt_http_end(struct stream *s, struct http_msg *msg)
 				BREAK_EXECUTION(s, msg->chn, end);
 		}
 	} RESUME_FILTER_END;
+
+	c_adv(msg->chn, offset);
+	*strm_off += offset;
+
 end:
 	DBG_TRACE_LEAVE(STRM_EV_STRM_ANA|STRM_EV_HTTP_ANA|STRM_EV_FLT_ANA, s);
 	return ret;