This patch is an attempt to prevent sending garbage data when
http-send-name-header replaced existing headers in the request.

http-send-name-header is applied late in the request processing. The buffer is
already ready to be sent to the backend server. When headers are removed, the
data length is not modified, resulting in sending more data than required. By
reducing the data length to send after removing them, this should fix the
issue.

This patch doesn't need to be ported to haproxy-1.5, which already readjust the
amount of data to be forwarded.
---
 src/proto_http.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/proto_http.c b/src/proto_http.c
index dc65cbd..e207587 100644
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -3981,6 +3981,7 @@ int http_send_name_header(struct http_txn *txn, struct 
http_msg *msg, struct buf
 
        char *hdr_val;
 
+       int delta = txn->req.eoh;
        while (http_find_header2(hdr_name, hdr_name_len, msg->sol, 
&txn->hdr_idx, &ctx)) {
                /* remove any existing values from the header */
                http_remove_header2(msg, buf, &txn->hdr_idx, &ctx);
@@ -3994,6 +3995,10 @@ int http_send_name_header(struct http_txn *txn, struct 
http_msg *msg, struct buf
        *hdr_val++ = ' ';
        hdr_val += strlcpy2(hdr_val, srv_name, trash + trashlen - hdr_val);
        http_header_add_tail2(buf, msg, &txn->hdr_idx, trash, hdr_val - trash);
+       delta -= txn->req.eoh;
+
+       /* Adjust buffer data length to send */
+       buf->send_max -= delta;
 
        return 0;
 }
-- 
1.7.10.4


Reply via email to