mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-22 14:21:25 +02:00
Code Issues Projects Releases Wiki Activity

MEDIUM: h2: don't gracefully close the connection anymore on Connection: close

Browse Source 
As reported by Lukas, it causes more harm than good, for example on
prompt for authentication. Now we have an "http-request reject" rule
to use instead of "http-request deny" if we absolutely want to close
the connection.
This commit is contained in:
Willy Tarreau 2017-11-24 08:17:28 +01:00
parent 90c3232e54
commit a76e4c2183
1 changed files with 6 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/mux_h2.c
View File

@ -2742,28 +2742,9 @@ static int h2s_frt_make_resp_headers(struct h2s *h2s, struct buffer *buf)
/* encode all headers, stop at empty name */
for (hdr = 1; hdr < sizeof(list)/sizeof(list[0]); hdr++) {
/* these ones do not exist in H2 and must be dropped. But if we
* see "connection: close", we also perform a graceful shutdown
* on the connection. Note that the match is not perfect but it
* is sufficient for dealing with some deny rules.
*/
if (isteq(list[hdr].n, ist("connection"))) {
if (!(h2c->flags & (H2_CF_GOAWAY_SENT|H2_CF_GOAWAY_FAILED)) &&
word_match(list[hdr].v.ptr, list[hdr].v.len, "close", 5)) {
if (h2c->last_sid < 0)
h2c->last_sid = (1U << 31) - 1;
if (h2c_send_goaway_error(h2c, h2s) <= 0) {
ret = 0;
goto end;
}
/* OK sent, but this changed the output buffer's
* contents hence the write position.
*/
goto try_again;
}
continue;
}
else if (isteq(list[hdr].n, ist("proxy-connection")) ||
/* these ones do not exist in H2 and must be dropped. */
if (isteq(list[hdr].n, ist("connection")) ||
isteq(list[hdr].n, ist("proxy-connection")) ||
isteq(list[hdr].n, ist("keep-alive")) ||
isteq(list[hdr].n, ist("upgrade")) ||
isteq(list[hdr].n, ist("transfer-encoding")))