From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 10 Jul 2020 08:01:26 +0000 (+0200)
Subject: BUG/MEDIUM: mux-h1: Continue to process request when switching in tunnel mode
X-Git-Tag: v2.3-dev1~21
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=23021ad7f1d9d0e924aa5e5c6c4103b51a805af0;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-h1: Continue to process request when switching in tunnel mode

When input data are processed, if the request is switched in tunnel mode on a
protocol upgrade, we must continue the processing. Otherwise, pending input data
will only be processed on the next wakeup. So when new input data are received,
on a timeout expiration or shutdown. Worst, if the input buffer is full when it
happens, only a timeout or a shutdown will unblock the situation.

This patch should fix the issue #737. It must be backported as far as 1.9. The
bug does not seem to affect the 2.0 and 1.9 because, on a protocol upgrade, the
request is switched in tunnel mode when the response is sent to the client. But
the bug is present, so the backport remains necessary.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 3268aff6e3..b3fa8f505f 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -1456,8 +1456,10 @@ static size_t h1_process_input(struct h1c *h1c, struct buffer *buf, size_t count
 			else if (h1s->req.state < H1_MSG_DONE || h1s->res.state < H1_MSG_DONE) {
 				h1c->flags |= H1C_F_IN_BUSY;
 				TRACE_STATE("switch h1c in busy mode", H1_EV_RX_DATA|H1_EV_H1C_BLK, h1c->conn, h1s);
+				break;
 			}
-			break;
+			else
+				break;
 		}
 		else if (h1m->state == H1_MSG_TUNNEL) {
 			TRACE_PROTO("parsing tunneled data", H1_EV_RX_DATA, h1c->conn, h1s);