Willy Tarreau bbf824933f BUG/MINOR: h2: always trim leading and trailing LWS in header values ...

Annika Wickert reported some occasional disconnections between haproxy
and varnish when communicating over HTTP/2, with varnish complaining
about protocol errors while captures looked apparently normal. Nils
Goroll managed to reproduce this on varnish by injecting the capture of
the outgoing haproxy traffic and noticed that haproxy was forwarding a
header value containing a trailing space, which is now explicitly
forbidden since RFC9113.

It turns out that the only way for such a header to pass through haproxy
is to arrive in h2 and not be edited, in which case it will arrive in
HTX with its undesired spaces. Since the code dealing with HTX headers
always trims spaces around them, these are not observable in dumps, but
only when started in debug mode (-d). Conversions to/from h1 also drop
the spaces.

With this patch we trim LWS both on input and on output. This way we
always present clean headers in the whole stack, and even if some are
manually crafted by the configuration or Lua, they will be trimmed on
the output.

This must be backported to all stable versions.

Thanks to Annika for the helpful capture and Nils for the help with
the analysis on the varnish side!

2025-02-24 09:39:57 +01:00

..

acl.c

…

action.c

…

activity.c

…

applet.c

…

arg.c

…

auth.c

…

backend.c

…

base64.c

…

buf.c

…

cache.c

…

calltrace.c

…

cbuf.c

…

cebtree-prv.h

…

cebu32_tree.c

…

cebu64_tree.c

…

cebua_tree.c

…

cebub_tree.c

…

cebuib_tree.c

…

cebuis_tree.c

…

cebul_tree.c

…

cebus_tree.c

…

cfgcond.c

…

cfgdiag.c

…

cfgparse-global.c

…

cfgparse-listen.c

…

cfgparse-quic.c

…

cfgparse-ssl.c

…

cfgparse-tcp.c

…

cfgparse-unix.c

…

cfgparse.c

…

channel.c

…

check.c

…

chunk.c

…

cli.c

…

clock.c

…

compression.c

…

connection.c

…

cpuset.c

…

debug.c

…

dgram.c

…

dict.c

…

dns_ring.c

…

dns.c

…

dynbuf.c

…

eb32sctree.c

…

eb32tree.c

…

eb64tree.c

…

ebimtree.c

…

ebistree.c

…

ebmbtree.c

…

ebpttree.c

…

ebsttree.c

…

ebtree.c

…

errors.c

…

ev_epoll.c

…

ev_evports.c

…

ev_kqueue.c

…

ev_poll.c

…

ev_select.c

…

event_hdl.c

…

extcheck.c

…

fcgi-app.c

…

fcgi.c

…

fd.c

…

filters.c

…

fix.c

…

flt_bwlim.c

…

flt_http_comp.c

…

flt_spoe.c

…

flt_trace.c

…

freq_ctr.c

…

frontend.c

…

guid.c

…

h1_htx.c

…

h1.c

…

h2.c

BUG/MINOR: h2: always trim leading and trailing LWS in header values

2025-02-24 09:39:57 +01:00

h3_stats.c

…

h3.c

…

haproxy.c

…

hash.c

…

hlua_fcn.c

…

hlua.c

…

hpack-dec.c

…

hpack-enc.c

…

hpack-huff.c

…

hpack-tbl.c

…

hq_interop.c

…

http_acl.c

…

http_act.c

…

http_ana.c

…

http_client.c

…

http_conv.c

…

http_ext.c

…

http_fetch.c

…

http_htx.c

…

http_rules.c

…

http.c

…

htx.c

…

init.c

…

jwt.c

…

lb_chash.c

…

lb_fas.c

…

lb_fwlc.c

…

lb_fwrr.c

…

lb_map.c

…

lb_ss.c

…

limits.c

…

linuxcap.c

…

listener.c

…

log.c

…

lru.c

…

mailers.c

…

map.c

…

mjson.c

…

mqtt.c

…

mux_fcgi.c

…

mux_h1.c

…

mux_h2.c

BUG/MINOR: h2: always trim leading and trailing LWS in header values

2025-02-24 09:39:57 +01:00

mux_pt.c

…

mux_quic.c

…

mux_spop.c

…

mworker-prog.c

…

mworker.c

…

namespace.c

…

ncbuf.c

…

pattern.c

…

payload.c

…

peers.c

…

pipe.c

…

pool.c

…

proto_quic.c

…

proto_rhttp.c

…

proto_sockpair.c

…

proto_tcp.c

…

proto_udp.c

…

proto_uxdg.c

…

proto_uxst.c

…

protocol.c

…

proxy.c

…

qmux_http.c

…

qmux_trace.c

…

qpack-dec.c

…

qpack-enc.c

…

qpack-tbl.c

…

queue.c

…

quic_ack.c

…

quic_cc_bbr.c

…

quic_cc_cubic.c

…

quic_cc_drs.c

…

quic_cc_newreno.c

…

quic_cc_nocc.c

…

quic_cc.c

…

quic_cid.c

…

quic_cli.c

…

quic_conn.c

…

quic_fctl.c

…

quic_frame.c

…

quic_loss.c

…

quic_openssl_compat.c

…

quic_pacing.c

…

quic_retransmit.c

…

quic_retry.c

…

quic_rules.c

…

quic_rx.c

…

quic_sock.c

…

quic_ssl.c

…

quic_stats.c

…

quic_stream.c

…

quic_tls.c

…

quic_token.c

…

quic_tp.c

…

quic_trace.c

…

quic_tx.c

…

raw_sock.c

…

regex.c

…

resolvers.c

…

ring.c

…

sample.c

…

server_state.c

…

server.c

…

session.c

…

sha1.c

…

shctx.c

…

signal.c

…

sink.c

…

slz.c

…

sock_inet.c

…

sock_unix.c

…

sock.c

…

ssl_ckch.c

…

ssl_clienthello.c

…

ssl_crtlist.c

…

ssl_gencert.c

…

ssl_ocsp.c

…

ssl_sample.c

…

ssl_sock.c

…

ssl_utils.c

…

stats-file.c

…

stats-html.c

…

stats-json.c

…

stats-proxy.c

…

stats.c

…

stconn.c

…

stick_table.c

…

stream.c

…

systemd.c

…

task.c

…

tcp_act.c

…

tcp_rules.c

…

tcp_sample.c

…

tcpcheck.c

…

thread.c

…

time.c

…

tools.c

…

trace.c

…

uri_auth.c

…

uri_normalizer.c

…

vars.c

…

version.c

…

wdt.c

…

xprt_handshake.c

…

xprt_quic.c

…