From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 23 Sep 2026 08:01:59 +0000 (+0200)
Subject: BUG/MINOR: mux-h2: Don't expect more HTX data on 1xx interim responses
X-Git-Tag: v3.5-dev8~132
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=1f70dbfbb17cea3deae9315c17ff33ec157e1f20;p=haproxy.git

BUG/MINOR: mux-h2: Don't expect more HTX data on 1xx interim responses

Commit b70921f2c ("BUG/MINOR: mux-h2: Properly handle full or truncated HTX
messages on shut") introduced a regression. When the response start-line had
the HTX_SL_F_XFER_LEN flag set, the H2 stream was flagged with
H2_SF_MORE_HTX_DATA, as if a payload was expected after the response
headers. This was also set for 1xx interim responses. If a final response
with an unknown length was received (no HTX_SL_F_XFER_LEN set), the flag
H2_SF_MORE_HTX_DATA was not removed, leading to an error. The H2 stream was
seen as truncated when a shut was performed and it was reset with a
RST_STREAM(CANCEL).

To fix the issue, H2_SF_MORE_HTX_DATA flag is no longer set for 1XX interim
responses.

This patch must be backported as far as 2.8.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 00272fd03..7d0535884 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -6738,7 +6738,7 @@ static size_t h2s_snd_fhdrs(struct h2s *h2s, struct htx *htx)
 			BUG_ON(sl); /* Only one start-line expected */
 			sl = htx_get_blk_ptr(htx, blk);
 			h2s->status = sl->info.res.status;
-			if (sl->flags & HTX_SL_F_XFER_LEN)
+			if ((sl->flags & HTX_SL_F_XFER_LEN) && (h2s->status == 101 || h2s->status >= 200))
 				h2s->flags |= H2_SF_MORE_HTX_DATA;
 			if ((sl->flags & HTX_SL_F_BODYLESS_RESP) || h2s->status == 204 || h2s->status == 304)
 				h2s->flags |= H2_SF_BODYLESS_RESP;