From: Christopher Faulet <cfaulet@haproxy.com>
Date: Tue, 6 Jan 2026 14:36:23 +0000 (+0100)
Subject: BUG/MEDIUM: stconn: Move data from <kip> to <kop> during zero-copy forwarding
X-Git-Tag: v3.4-dev2~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=83457b9e384132e6126dd988966203d5c578a1fe;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: stconn: Move data from <kip> to <kop> during zero-copy forwarding

The <kip> of producer was not forwarded to <kop> of consumer when zero-copy
data forwarding was tried. Because of the issue, the chunking of emitted H1
messages could be invalid.

To fix the bug, sc_ep_fwd_kip() must be called at this stage.

This fix is related to the previous one (529a8dbfb "BUG/MEDIUM: mux-h1: Take
care to update <kop> value during zero-copy forwarding"). Both are required
to fully fix the issue #3230.

This patch must be backported to 3.3.
---

diff --git a/src/stconn.c b/src/stconn.c
index 1f2294fa2..9d54dbff4 100644
--- a/src/stconn.c
+++ b/src/stconn.c
@@ -1351,6 +1351,7 @@ int sc_conn_recv(struct stconn *sc)
 			flags |= CO_RFL_BUF_FLUSH;
 			goto abort_fastfwd;
 		}
+		sc_ep_fwd_kip(sc, sc_opposite(sc));
 		ret = conn->mux->fastfwd(sc, ic->to_forward, flags);
 		if (ret < 0)
 			goto abort_fastfwd;
@@ -2033,6 +2034,7 @@ int sc_applet_recv(struct stconn *sc)
 			flags |= CO_RFL_BUF_FLUSH;
 			goto abort_fastfwd;
 		}
+		sc_ep_fwd_kip(sc, sc_opposite(sc));
 		ret = appctx_fastfwd(sc, ic->to_forward, flags);
 		if (ret < 0)
 			goto abort_fastfwd;