From a2897a3a55455e926e6a4488221a581f814d42b9 Mon Sep 17 00:00:00 2001 From: Eduard Bagdasaryan Date: Thu, 7 Oct 2021 21:44:45 +0000 Subject: [PATCH] Remove HTTP reply header completion hack (#910) Treat responses with truncated HTTP headers (i.e. no CRLF after all the field-lines) as malformed, replacing them with an HTTP 502 ERR_INVALID_RESP error (same as any other HTTP response with malformed headers would get). Since Bug 2879 (commit da6c841 and earlier v2-only changes), Squid was "fixing" such truncated headers by adding an extra CRLF sequence and re-parsing them. Depending on the truncation circumstances, that old workaround could result in rather bad outcomes for Squid and its clients. Hopefully, we no longer need to work around such bugs. If we do, we should do it in a safer manner and with admin permission. --- src/http.cc | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/src/http.cc b/src/http.cc index 4a7c3daf63..a669b87004 100644 --- a/src/http.cc +++ b/src/http.cc @@ -672,15 +672,8 @@ HttpStateData::processReplyHeader() if (hp->needsMoreData()) { if (eof) { // no more data coming - /* Bug 2879: Replies may terminate with \r\n then EOF instead of \r\n\r\n. - * We also may receive truncated responses. - * Ensure here that we have at minimum two \r\n when EOF is seen. - */ - inBuf.append("\r\n\r\n", 4); - // retry the parse - parsedOk = hp->parse(inBuf); - // sync the buffers after parsing. - inBuf = hp->remaining(); + assert(!parsedOk); + // fall through to handle this premature EOF as an error } else { debugs(33, 5, "Incomplete response, waiting for end of response headers"); return; @@ -693,7 +686,11 @@ HttpStateData::processReplyHeader() debugs(11, 3, "Non-HTTP-compliant header:\n---------\n" << inBuf << "\n----------"); flags.headers_parsed = true; HttpReply *newrep = new HttpReply; - newrep->sline.set(Http::ProtocolVersion(), hp->parseStatusCode); + // hp->needsMoreData() means hp->parseStatusCode is unusable, but, here, + // it also means that the reply header got truncated by a premature EOF + assert(!hp->needsMoreData() || eof); + const auto scode = hp->needsMoreData() ? Http::scInvalidHeader : hp->parseStatusCode; + newrep->sline.set(Http::ProtocolVersion(), scode); setVirginReply(newrep); return; } -- 2.47.2