From 5be92ff23f7494902091b1bf76d7787ec3fbf706 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Fri, 1 Feb 2019 15:51:59 +0100 Subject: [PATCH] BUG/MEDIUM: mux-h2: always omit :scheme and :path for the CONNECT method This is mandated by RFC7540 #8.3, these pseudo-headers must not be emitted with the CONNECT method. This must be backported to 1.9. --- src/mux_h2.c | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/src/mux_h2.c b/src/mux_h2.c index 5fdaadf50..1c6f3d209 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -4425,20 +4425,27 @@ static size_t h2s_htx_bck_make_req_headers(struct h2s *h2s, struct htx *htx) goto full; } - /* encode the scheme which is always "https" (or 0x86 for "http") */ - if (!hpack_encode_scheme(&outbuf, ist("https"))) { - /* output full */ - if (b_space_wraps(&h2c->mbuf)) - goto realign_again; - goto full; - } + /* RFC7540 #8.3: the CONNECT method must have : + * - :authority set to the URI part (host:port) + * - :method set to CONNECT + * - :scheme and :path omitted + */ + if (sl->info.req.meth != HTTP_METH_CONNECT) { + /* encode the scheme which is always "https" (or 0x86 for "http") */ + if (!hpack_encode_scheme(&outbuf, ist("https"))) { + /* output full */ + if (b_space_wraps(&h2c->mbuf)) + goto realign_again; + goto full; + } - /* encode the path, which necessarily is the second one */ - if (!hpack_encode_path(&outbuf, path)) { - /* output full */ - if (b_space_wraps(&h2c->mbuf)) - goto realign_again; - goto full; + /* encode the path, which necessarily is the second one */ + if (!hpack_encode_path(&outbuf, path)) { + /* output full */ + if (b_space_wraps(&h2c->mbuf)) + goto realign_again; + goto full; + } } /* encode all headers, stop at empty name */