From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 23 Sep 2026 04:40:03 +0000 (+0000)
Subject: BUG/MINOR: tcpcheck: refresh the start-line after updating the authority
X-Git-Tag: v3.5-dev8~122
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D/doc/static/gitweb.js?a=commitdiff_plain;h=8c38a4b4e1790ae5ddb43287489c5e6bcfbe0a28;p=haproxy.git

BUG/MINOR: tcpcheck: refresh the start-line after updating the authority

When an HTTP health-check request was built with an absolute URI, each
"host" header set by "http-check send" updated the authority of the URI with
http_update_authority(). This rewrote the start-line, which could move it
elsewhere in the HTX message. So, in tcpcheck_eval_send(), the start-line
pointer <sl> must be renewed in that case.

Let's retrieve the start-line again after each authority update. A reg-test
was added.

This must be backported to all supported versions.
---

diff --git a/reg-tests/checks/http-check-send-authority.vtc b/reg-tests/checks/http-check-send-authority.vtc
new file mode 100644
index 000000000..a4d2f8814
--- /dev/null
+++ b/reg-tests/checks/http-check-send-authority.vtc
@@ -0,0 +1,35 @@
+varnishtest "Health-checks: http-check send with an absolute URI and a host header"
+feature ignore_unknown_macro
+
+# When an HTTP health-check request is sent with an absolute URI, a host
+# header updates the authority of the URI. This may move the start-line in
+# the HTX message, so the flags set on the start-line afterwards, such as
+# the one announcing the content-length of the body, must be set on the new
+# one. Otherwise the request is sent with a body but without its
+# content-length.
+
+server s1 {
+    rxreq
+    expect req.method == POST
+    expect req.url == "http://a-much-longer-host-name.example.org/chk"
+    expect req.http.host == "a-much-longer-host-name.example.org"
+    expect req.http.content-length == 5
+    expect req.bodylen == 5
+    expect req.body == "hello"
+    txresp
+} -start
+
+haproxy h1 -conf {
+    defaults
+        mode http
+        timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+    backend be
+        option httpchk
+        http-check send meth POST uri http://a/chk ver HTTP/1.1 hdr host a-much-longer-host-name.example.org body "hello"
+        server srv ${s1_addr}:${s1_port} check inter 100ms rise 1 fall 1
+} -start
+
+server s1 -wait
diff --git a/src/tcpcheck.c b/src/tcpcheck.c
index d0e9770d8..e924155d9 100644
--- a/src/tcpcheck.c
+++ b/src/tcpcheck.c
@@ -1791,6 +1791,8 @@ enum tcpcheck_eval_ret tcpcheck_eval_send(struct check *check, struct tcpcheck_r
 				if ((sl->flags & HTX_SL_F_HAS_AUTHORITY) && isteqi(hdr->name, ist("host"))) {
 					if (!http_update_authority(htx, sl, hdr_value))
 						goto error_htx;
+					/* the start-line may have been moved */
+					sl = http_get_stline(htx);
 				}
 				if (isteqi(hdr->name, ist("connection")))
 					connection_hdr = 1;