From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Tue, 29 Sep 2026 10:05:41 +0000 (+0200)
Subject: BUG/MINOR: h3: reject RS/SS for QPACK uni streams
X-Git-Tag: v3.5-dev9~175
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=fde77d1d1fe230b54bf3012ab65d51056f7838e8;p=haproxy.git

BUG/MINOR: h3: reject RS/SS for QPACK uni streams

A H3 peer must not close its qpack encoder/decoder stream. This is
already detected when a stream frame with FIN is received.

This patch extends the detection to RESET_STREAM frames. A similar error
H3_CLOSED_CRITICAL_STREAM is emitted.

This must be backported up to 2.8.
---

diff --git a/src/h3.c b/src/h3.c
index 60b83e5c9..fb6d9556b 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -3406,6 +3406,13 @@ static int h3_close(struct qcs *qcs, enum qcc_app_ops_close_side side)
 		qcc_report_glitch(qcs->qcc, 1);
 		return 1;
 	}
+	else if (h3s->type == H3S_T_QPACK_DEC || h3s->type == H3S_T_QPACK_ENC) {
+		TRACE_ERROR("closure detected on QPACK stream", H3_EV_H3S_END, qcs->qcc->conn, qcs);
+		qcc_set_error(qcs->qcc, H3_ERR_CLOSED_CRITICAL_STREAM, 1,
+		              muxc_tevt_type_proto_err);
+		qcc_report_glitch(qcs->qcc, 1);
+		return 1;
+	}
 
 	return 0;
 }