From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 10 Jul 2020 08:01:26 +0000 (+0200)
Subject: BUG/MEDIUM: mux-h1: Continue to process request when switching in tunnel mode
X-Git-Tag: v2.1.8~30
X-Git-Url: http://git.haproxy.org/?a=commitdiff_plain;h=cd12873354da09aead5c953a778a895b3ddc8823;p=haproxy-2.1.git

BUG/MEDIUM: mux-h1: Continue to process request when switching in tunnel mode

When input data are processed, if the request is switched in tunnel mode on a
protocol upgrade, we must continue the processing. Otherwise, pending input data
will only be processed on the next wakeup. So when new input data are received,
on a timeout expiration or shutdown. Worst, if the input buffer is full when it
happens, only a timeout or a shutdown will unblock the situation.

This patch should fix the issue #737. It must be backported as far as 1.9. The
bug does not seem to affect the 2.0 and 1.9 because, on a protocol upgrade, the
request is switched in tunnel mode when the response is sent to the client. But
the bug is present, so the backport remains necessary.

(cherry picked from commit 23021ad7f1d9d0e924aa5e5c6c4103b51a805af0)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 4814c74842d13dcf8d948910902f248263f80eed)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 401bf09..d2f266a 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -1453,8 +1453,10 @@ static size_t h1_process_input(struct h1c *h1c, struct buffer *buf, size_t count
 			else if (h1s->req.state < H1_MSG_DONE || h1s->res.state < H1_MSG_DONE) {
 				h1c->flags |= H1C_F_IN_BUSY;
 				TRACE_STATE("switch h1c in busy mode", H1_EV_RX_DATA|H1_EV_H1C_BLK, h1c->conn, h1s);
+				break;
 			}
-			break;
+			else
+				break;
 		}
 		else if (h1m->state == H1_MSG_TUNNEL) {
 			TRACE_PROTO("parsing tunneled data", H1_EV_RX_DATA, h1c->conn, h1s);