From 0d4271cdae18780de79e1ce997d562f91eeee316 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Tue, 3 Sep 2024 14:10:29 +0200 Subject: [PATCH] BUG/MEDIUM: mux-h1: Properly handle empty message when an error is triggered When a 400/408/500/501 error is returned by the H1 multiplexer, we first try to get the error message of the proxy before using the default one. This may be configured to be mapped on /dev/null or on an empty file. In that case, no message is emitted, as expected. But everything is handled as the error was successfully sent. However, there is an bug here. In h1_send_error() function, this case is not properly handled. The flag H1C_F_ABRTED is not set on the H1 connection as it should be and h1_close() function is not called, leaving the H1 connection in an undefined state. It is especially an issue when a "empty" 408-Request-Time-out error is emitted while there are data blocked in the output buffer. In that case, the connection remains openned until the client closes and a "cR--"/408 is logged repeatedly, every time the client timeout is reached. This patch must backported as far as 2.8. --- src/mux_h1.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/mux_h1.c b/src/mux_h1.c index 43bc6d57e..13066ced6 100644 --- a/src/mux_h1.c +++ b/src/mux_h1.c @@ -3558,7 +3558,7 @@ static int h1_send_error(struct h1c *h1c) b_is_null(h1c->px->replies[rc]->body.errmsg)) { /* Empty error, so claim a success */ ret = 1; - goto out; + goto out_abort; } if (h1c->flags & (H1C_F_OUT_ALLOC|H1C_F_OUT_FULL)) { @@ -3590,6 +3590,7 @@ static int h1_send_error(struct h1c *h1c) h1s_destroy(h1c->h1s); } + out_abort: h1c->flags = (h1c->flags & ~(H1C_F_WAIT_NEXT_REQ|H1C_F_ABRT_PENDING)) | H1C_F_ABRTED; h1_close(h1c); out: