From: Christopher Faulet <cfaulet@haproxy.com>
Date: Tue, 19 May 2026 09:15:38 +0000 (+0200)
Subject: BUG/MINOR: h1: Don't mask websocket protocol if multiple protocols used
X-Git-Tag: v3.4-dev13~40
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b74b5289c8ab27002700416974867edc2ae0676c;p=thirdparty%2Fhaproxy.git

BUG/MINOR: h1: Don't mask websocket protocol if multiple protocols used

During H1 message parsing, the Upgrade header values are checked to detect
"websocket" prototol, to properly handle websocket upgrades between H1 and
H2 and to possibly reject messages if mandatory headers are missing.

However, the flag is reset for each new Upgrade header and the information
may be lost. So never reset it.

This patch must be backported as far as 2.4.
---

diff --git a/reg-tests/http-messaging/websocket.vtc b/reg-tests/http-messaging/websocket.vtc
index 9567ea577..3990ddb9a 100644
--- a/reg-tests/http-messaging/websocket.vtc
+++ b/reg-tests/http-messaging/websocket.vtc
@@ -146,7 +146,7 @@ client c1 -connect ${hap_fe1_sock} {
 } -run
 
 # missing websocket key
-client c2 -connect ${hap_fe1_sock} {
+client c2_1 -connect ${hap_fe1_sock} {
 	txreq \
 	  -req "GET" \
 	  -url "/" \
@@ -158,6 +158,19 @@ client c2 -connect ${hap_fe1_sock} {
 	expect resp.status == 400
 } -run
 
+client c2_2 -connect ${hap_fe1_sock} {
+	txreq \
+	  -req "GET" \
+	  -url "/" \
+	  -hdr "host: 127.0.0.1" \
+	  -hdr "connection: upgrade" \
+	  -hdr "upgrade: proto1, websocket, proto2" \
+	  -hdr "upgrade: proto3"
+
+	rxresp
+	expect resp.status == 400
+} -run
+
 # missing key on server side
 client c3 -connect ${hap_fe2_sock} {
 	txreq \
diff --git a/src/h1.c b/src/h1.c
index 792737c9e..4ea759191 100644
--- a/src/h1.c
+++ b/src/h1.c
@@ -281,8 +281,6 @@ void h1_parse_upgrade_header(struct h1m *h1m, struct ist *value)
 	char *e, *n, *p;
 	struct ist word;
 
-	h1m->flags &= ~H1_MF_UPG_WEBSOCKET;
-
 	word.ptr = value->ptr - 1; // -1 for next loop's pre-increment
 	p = value->ptr;
 	e = value->ptr + value->len;