From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 13 Apr 2022 15:48:54 +0000 (+0200)
Subject: BUG/MEDIUM: mux-h1: Don't request more room on partial trailers
X-Git-Tag: v2.6-dev6~20
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ae660be547eb72b5c213d87769e60c527fe6b7cd;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-h1: Don't request more room on partial trailers

The commit 744451c7c ("BUG/MEDIUM: mux-h1: Properly detect full buffer cases
during message parsing") introduced a regression if trailers are not
received in one time. Indeed, in this case, nothing is appended in the
channel buffer, while there are some data in the input buffer. In this case,
we must not request more room to the upper layer, especially because the
channel buffer can be empty.

To fix the issue, on trailers parsing, we consider the H1 stream as
congested when the max size allowed is reached. Of course, the H1 stream is
also considered as congested if the trailers are too big and the channel
buffer is not empty.

This patch should fix the issue #1657. It must be backported as far as 2.0.
---

diff --git a/src/h1_htx.c b/src/h1_htx.c
index 3d74a4c991..61a60eeb50 100644
--- a/src/h1_htx.c
+++ b/src/h1_htx.c
@@ -878,8 +878,14 @@ int h1_parse_msg_tlrs(struct h1m *h1m, struct htx *dsthtx,
 	struct h1m tlr_h1m;
 	int ret = 0;
 
-	if (!max || !b_data(srcbuf))
+	if (b_data(srcbuf) == ofs) {
+		/* Nothing to parse */
 		goto end;
+	}
+	if (!max) {
+		/* No more room */
+		goto output_full;
+	}
 
 	/* Realing input buffer if necessary */
 	if (b_peek(srcbuf, ofs) > b_tail(srcbuf))
diff --git a/src/mux_h1.c b/src/mux_h1.c
index cd5f3fb737..79fdb553ae 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -1709,7 +1709,7 @@ static size_t h1_handle_trailers(struct h1s *h1s, struct h1m *h1m, struct htx *h
 			TRACE_ERROR("parsing error, reject H1 message", H1_EV_RX_DATA|H1_EV_RX_TLRS|H1_EV_H1S_ERR, h1s->h1c->conn, h1s);
 			h1_capture_bad_message(h1s->h1c, h1s, h1m, buf);
 		}
-		else if (ret == -2 || b_data(buf) != *ofs) {
+		else if (ret == -2) {
 			TRACE_STATE("RX path congested, waiting for more space", H1_EV_RX_DATA|H1_EV_RX_TLRS|H1_EV_H1S_BLK, h1s->h1c->conn, h1s);
 			h1s->flags |= H1S_F_RX_CONGESTED;
 		}