arturobernalg opened a new pull request, #1140: URL: https://github.com/apache/tomcat/pull/1140
Backport of https://github.com/apache/tomcat/pull/1137 to the 9.0.x branch. RFC 9113 §6.10 states: "A receiver MUST treat the receipt of any other type of frame or a frame on a different stream as a connection error (Section 5.4.1) of type PROTOCOL_ERROR." There is no exemption for RST_STREAM. The previous code silently ignored a RST_STREAM received while a CONTINUATION sequence was in progress (the header block was left open), instead of responding with a GOAWAY of type PROTOCOL_ERROR. Additionally, non-CONTINUATION frames during an open header block incorrectly used COMPRESSION_ERROR rather than PROTOCOL_ERROR. This fix: - Removes the RST_STREAM no-op and treats it as a connection error of type PROTOCOL_ERROR. - Corrects the error code from COMPRESSION_ERROR to PROTOCOL_ERROR for all mid-header-block violations (wrong frame type, wrong stream id). A new test `testHeaderContinuationInterruptedByRst` in `TestHttp2Section_4_3` demonstrates the fix: the server must respond with GOAWAY PROTOCOL_ERROR when a RST_STREAM interrupts an open header block. Related: https://bz.apache.org/bugzilla/show_bug.cgi?id=70303 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
