mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-21 13:51:26 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: quic: prevent freeze after early QCS closure

Browse Source 
A connection freeze may occur if a QCS is released before transmitting
any data. This can happen when an error is detected early by the stream,
for example during HTTP response headers encoding, forcing the whole
connection closure.

In this case, a connection error is registered by the QUIC MUX to the
lower layer. MUX is then release and xprt layer is notified to prepare
CONNECTION_CLOSE emission. However, this is prevented because quic_conn
streams tree is not empty as it contains the qc_stream_desc previously
attached to the failed QCS instance. The connection will freeze until
QUIC idle timeout.

This situation is caused by an omission during qc_stream_desc release
operation. In the described situation, qc_stream_desc current buffer is
empty and can thus by removed, which is the purpose of this patch. This
unblocks this previously failed situation, with qc_stream_desc removal
from quic_conn tree.

This issue can be reproduced by modifying H3/QPACK code to return an
early error during HEADERS response processing.

This must be backported up to 2.6, after a period of observation.
This commit is contained in:
Amaury Denoyelle 2024-08-07 18:01:51 +02:00
parent d5da87b5dc
commit 3ef1ee477d
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/quic_stream.c
View File

@ -120,12 +120,11 @@ void qc_stream_desc_release(struct qc_stream_desc *stream,
BUG_ON(final_size > tail_offset);
/* Remove unsent data from current buffer. */
if (final_size < tail_offset) {
if (final_size < tail_offset)
b_sub(buf, tail_offset - final_size);
/* Remove buffer if all ACK already received. */
if (!b_data(buf))
qc_stream_buf_free(stream, &stream_buf);
}
if (!b_data(buf))
qc_stream_buf_free(stream, &stream_buf);
/* A released stream does not use <stream.buf>. */
stream->buf = NULL;