From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 7 Oct 2026 14:35:59 +0000 (+0200)
Subject: BUG/MINOR: http-fetch: don't report pseudo-headers in TCP mode
X-Git-Tag: v3.5-dev9~30
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=97109ffe57831c8912c12ea7e4a5a5d8a55099da;p=haproxy.git

BUG/MINOR: http-fetch: don't report pseudo-headers in TCP mode

In TCP mode, HTTP sample fetches parse the raw request found in the channel
buffer using h1_headers_to_hdr_list() before converting it to HTX. But the
H1_MF_NO_PHDR flag was not set, so the ":method" and ":path" pseudo-headers
produced by the parser were added as regular headers to the HTX
message. Thus, for "GET /x HTTP/1.1" with a single Host header, req.hdr_cnt
returns 3, req.hdrs and req.hdr_names contain ":method" and ":path", and
req.hdr(:path) returns the URI, unlike in HTTP mode. It also consumes two
header slots, so that requests with 99 or 100 headers make the fetches fail
in TCP mode while they are accepted in HTTP mode.

Let's set H1_MF_NO_PHDR for this parsing.

This was introduced by commit ef453ed9b ("MINOR: http_fetch: Add
smp_prefetch_htx") in 1.9-dev7. It may be backported to all stable versions.
---

diff --git a/src/http_fetch.c b/src/http_fetch.c
index af5dc3c07..83f2ff5ee 100644
--- a/src/http_fetch.c
+++ b/src/http_fetch.c
@@ -273,6 +273,8 @@ struct htx *smp_prefetch_htx(struct sample *smp, struct channel *chn, struct che
 			b_slow_realign(buf, trash.area, 0);
 
 		h1m_init_req(&h1m);
+		/* pseudo-headers must not be turned into regular headers */
+		h1m.flags |= H1_MF_NO_PHDR;
 		ret = h1_headers_to_hdr_list(b_head(buf), b_stop(buf),
 					     hdrs, sizeof(hdrs)/sizeof(hdrs[0]), &h1m, &h1sl);
 		if (ret <= 0) {