Re: HTTP/2 Termination vs. Firefox Quantum

[Willy Tarreau]

On Fri, Dec 29, 2017 at 06:56:36PM +0000, Lucas Rolff wrote:
> h2_make_h1_request:153
> h2_frt_decode_headers:2621
> h2_frt_decode_headers:2643
> 
> /* this can be any type of header */
> /* RFC7540#8.1.2: upper case not allowed in header field names */
> for (i = 0; i < list[idx].n.len; i++)
>         if ((uint8_t)(list[idx].n.ptr[i] - 'A') < 'Z' - 'A')
>                 goto fail;
> 
> That's an interesting place to fail

OK I can propose the attached patch which will dump all the requests to
stderr, as they are received or extracted from the dynamic headers table.
The patch needs to be applied without the previous ones. This will look
like this :

  <<<<<<<<<<<<<<<<<<
  :authority: 127.0.0.1:4443
  user-agent: curl/7.57.0
  accept: */*
  >>>>>>>>>>>>>>>>>
  <<<<<<<<<<<<<<<<<<
  :authority: 127.0.0.1:4443
  user-agent: curl/7.57.0
  accept: */*
  aaa: AaA
  >>>>>>>>>>>>>>>>>

The '<<<' and '>>>' enclose a request. The final one will instead use "###"
to indicate that at least one bad char was received, or '!!!' to indicate
that another error was met. Please note that it will silently let the request
pass through so you need to check the output to see if these "###" happen.

Maybe we'll find a bug in the dynamic headers table causing some crap to
be returned. Or maybe we'll find that a given browser occasionally sends
a bad header.

Cheers,
willy

diff --git a/src/h2.c b/src/h2.c
index 43ed7f3..9ca60de 100644
--- a/src/h2.c
+++ b/src/h2.c
@@ -31,6 +31,8 @@
 #include <common/http-hdr.h>
 #include <common/ist.h>
 
+#include <stdio.h>
+#include <types/global.h>
 
 /* Prepare the request line into <*ptr> (stopping at <end>) from pseudo headers
  * stored in <phdr[]>. <fields> indicates what was found so far. This should be
@@ -134,7 +136,9 @@ int h2_make_h1_request(struct http_hdr *list, char *out, 
int osize)
        int phdr;
        int ret;
        int i;
+       int bad=0;
 
+       fprintf(stderr, "<<<<<<<<<<<<<<<<<<\n");
        lck = ck = -1; // no cookie for now
        fields = 0;
        for (idx = 0; list[idx].n.len != 0; idx++) {
@@ -145,9 +149,13 @@ int h2_make_h1_request(struct http_hdr *list, char *out, 
int osize)
                else {
                        /* this can be any type of header */
                        /* RFC7540#8.1.2: upper case not allowed in header 
field names */
+
+                       fprintf(stderr, "%s: ", istpad(trash.str, 
list[idx].n).ptr);
+                       fprintf(stderr, "%s\n", istpad(trash.str, 
list[idx].v).ptr);
+
                        for (i = 0; i < list[idx].n.len; i++)
                                if ((uint8_t)(list[idx].n.ptr[i] - 'A') < 'Z' - 
'A')
-                                       goto fail;
+                                       bad=1;
 
                        phdr = h2_str_to_phdr(list[idx].n);
                }
@@ -296,8 +304,13 @@ int h2_make_h1_request(struct http_hdr *list, char *out, 
int osize)
        *(out++) = '\n';
        ret = out + osize - out_end;
  leave:
+       if (!bad)
+               fprintf(stderr, ">>>>>>>>>>>>>>>>>\n");
+       else
+               fprintf(stderr, "#################\n");
        return ret;
 
  fail:
+       fprintf(stderr, "!!!!!!!!!!!!!!!!!\n");
        return -1;
 }