From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 7 Oct 2026 09:54:05 +0000 (+0200)
Subject: BUG/MINOR: mux-h1: report payload parsing glitches to the session
X-Git-Tag: v3.5-dev10~142
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=60ad05efa270b95078a52b7ffa2fd9d549835de4;p=haproxy.git

BUG/MINOR: mux-h1: report payload parsing glitches to the session

Glitches detected by the H1 mux on a frontend connection are reported to the
session by h1_process(), by comparing the number of glitches before and
after parsing. But h1_process() only parses the beginning of messages. Once
the stream is created, the payload is parsed from h1_rcv_buf(), and the
glitches reported there (invalid chunk sizes, invalid chunk CRLF, invalid
trailers...) only increment the connection's counter, never the session's
one.

Now h1_rcv_buf() reports the new glitches to the session, like h1_process()
does.

This was introduced with the glitches support by commit 05b457002 ("MEDIUM:
mux-h1: implement basic glitches support") in 3.4. So this patch should be
backported to 3.4.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 12eb43d89..1b2fb6d7e 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -4954,8 +4954,14 @@ static size_t h1_rcv_buf(struct stconn *sc, struct buffer *buf, size_t count, in
 		goto end;
 	}
 
-	if (!(h1c->flags & H1C_F_IN_ALLOC))
+	if (!(h1c->flags & H1C_F_IN_ALLOC)) {
+		int prev_glitches = h1c->glitches;
+
 		ret = h1_process_demux(h1c, buf, count);
+
+		if (h1c->glitches != prev_glitches && !(h1c->flags & H1C_F_IS_BACK))
+			session_add_glitch_ctr(h1c->conn->owner, h1c->glitches - prev_glitches);
+	}
 	else
 		TRACE_DEVEL("h1c ibuf not allocated", H1_EV_H1C_RECV|H1_EV_H1C_BLK, h1c->conn);