]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MINOR: mux-h1: H2 preface rejection doesn't update stick-table glitches
authorChad Lavoie <clavoie@haproxy.com>
Fri, 22 May 2026 17:58:38 +0000 (13:58 -0400)
committerChristopher Faulet <cfaulet@haproxy.com>
Wed, 27 May 2026 08:53:00 +0000 (10:53 +0200)
commit 72fd357814e1 ("MEDIUM: mux-h1: Return an error on h2 upgrade
attempts if not allowed") added an h1_report_glitch() call on the new
405 path but exits via "goto no_parsing", which skips the
session_add_glitch_ctr() call at the end of the parse block. As a
result fc_glitches increments correctly but the per-session stick
counters never see it, breaking sc_glitch_cnt-based rate limiting of
the H2-preface-over-H1 abuse pattern.

No backport needed beyond the branches that took 72fd357814.

[cf: Patch was edited to move the goto label instead of duplicating
     the call to session_add_glitch_ctr]

src/mux_h1.c

index ec97d020de92d30644a812f55c506d3339420741..1ad6260fe6b7ef107b981a64a826b21c280863b3 100644 (file)
@@ -4257,11 +4257,11 @@ static int h1_process(struct h1c * h1c)
                                h1c->conn->xprt->subscribe(h1c->conn, h1c->conn->xprt_ctx, SUB_RETRY_RECV, &h1c->wait_event);
                        }
                }
+         no_parsing:
                if (h1c->glitches != prev_glitches && !(h1c->flags & H1C_F_IS_BACK))
                        session_add_glitch_ctr(sess, h1c->glitches - prev_glitches);
        }
 
-  no_parsing:
        h1_send(h1c);
 
        /* H1 connection must be released ASAP if: