From: Willy Tarreau <w@1wt.eu>
Date: Wed, 30 Jan 2019 18:28:32 +0000 (+0100)
Subject: BUG/MEDIUM: mux-h2: fix two half-closed to closed transitions
X-Git-Tag: v2.0-dev1~111
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fc10f599cc5e5606c15be4828848e04ed2c70f9c;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-h2: fix two half-closed to closed transitions

When receiving a HEADERS or DATA frame with END_STREAM set, we would
inconditionally switch to half-closed(remote). This is wrong because we
could already have been in half-closed(local) and need to switch to closed.
This happens in the following situations :
    - receipt of the end of a client upload after we've already responded
      (e.g. redirects to POST requests)
    - receipt of a response on the backend side after we've already finished
      sending the request (most common case).

This may possibly have caused some streams to stay longer than needed
at the end of a transfer, though this is not apparent in tests.

This must be backported to 1.9 and 1.8.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 49e2068325..35bdd173dd 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -1980,7 +1980,10 @@ static struct h2s *h2c_frt_handle_headers(struct h2c *h2c, struct h2s *h2s)
 		h2s->flags |= H2_SF_ES_RCVD;
 
 	if (h2s->flags & H2_SF_ES_RCVD) {
-		h2s->st = H2_SS_HREM;
+		if (h2s->st == H2_SS_OPEN)
+			h2s->st = H2_SS_HREM;
+		else
+			h2s_close(h2s);
 		h2s->cs->flags |= CS_FL_REOS;
 	}
 
@@ -2129,7 +2132,11 @@ static int h2c_frt_handle_data(struct h2c *h2c, struct h2s *h2s)
 
 	/* last frame */
 	if (h2c->dff & H2_F_DATA_END_STREAM) {
-		h2s->st = H2_SS_HREM;
+		if (h2s->st == H2_SS_OPEN)
+			h2s->st = H2_SS_HREM;
+		else
+			h2s_close(h2s);
+
 		h2s->flags |= H2_SF_ES_RCVD;
 		h2s->cs->flags |= CS_FL_REOS;