BUG/MEDIUM: mux-spop: Properly detect truncated frames on demux to report error
authorChristopher Faulet <cfaulet@haproxy.com>
Wed, 14 May 2025 07:22:45 +0000 (09:22 +0200)
committerWilly Tarreau <w@1wt.eu>
Tue, 20 May 2025 14:43:49 +0000 (16:43 +0200)
There was no test in the demux part to detect truncated frames and to report
an error at the connection level. The SPOP streams were properly switch to
half-closed state. But waiting the associated SPOE applets were woken up and
released, the SPOP connection could be woken up several times for nothing. I
never triggered the watchdog in that case, but it is not excluded.

Now, at the end of the demux function, if a specific test was added to
detect truncated frames to report an error and close the connection.

This patch must be backported to 3.1.

(cherry picked from commit 16314bb93c2c2c47c648da880ab55bf2ac01d9d4)
[wt: update ctx]
Signed-off-by: Willy Tarreau <w@1wt.eu>

src/mux_spop.c

index a1616e8..59ccf32 100644 (file)
@@ -2223,6 +2223,13 @@ static void spop_process_demux(struct spop_conn *spop_conn)
                        spop_conn->flags |= SPOP_CF_END_REACHED;
        }
 
+       if (spop_conn_read0_pending(spop_conn) && (spop_conn->flags & SPOP_CF_DEM_SHORT_READ) && b_data(&spop_conn->dbuf)) {
+               spop_conn_error(spop_conn, SPOP_ERR_INVALID);
+               spop_conn->state = SPOP_CS_CLOSED;
+               TRACE_ERROR("truncated data", SPOP_EV_RX_FRAME|SPOP_EV_RX_FHDR|SPOP_EV_SPOP_CONN_ERR, spop_conn->conn);
+               TRACE_STATE("switching to CLOSED", SPOP_EV_RX_FRAME|SPOP_EV_RX_FHDR|SPOP_EV_SPOP_CONN_ERR, spop_conn->conn);
+       }
+
        if (spop_strm && spop_strm_sc(spop_strm) &&
            (b_data(&spop_strm->rxbuf) ||
             spop_conn_read0_pending(spop_conn) ||