http: h2 fix handling of incomplete frame headers

Type: fix

Change-Id: I47155fd7d453b0e9bdcf39f5bc14139323a9a42e
Signed-off-by: Matus Fabian <[email protected]>

diff --git a/src/plugins/http/http2/http2.c b/src/plugins/http/http2/http2.c
index cde1a33..834d79e 100644 (file)
--- a/src/plugins/http/http2/http2.c
+++ b/src/plugins/http/http2/http2.c
@@ -2880,13 +2880,6 @@ http2_transport_rx_callback (http_conn_t *hc)
   if (PREDICT_FALSE (to_deq < HTTP2_FRAME_HEADER_SIZE))
     {
       HTTP_DBG (1, "to_deq %u is less than frame header size", to_deq);
-#if HTTP_DEBUG
-      u8 *tmp = 0;
-      vec_validate (tmp, to_deq - 1);
-      http_io_ts_read (hc, tmp, to_deq, 0);
-      clib_warning ("%U", format_hex_bytes, tmp, to_deq);
-#endif
-      http2_connection_error (hc, HTTP2_ERROR_PROTOCOL_ERROR, 0);
       return;
     }
 
@@ -2920,20 +2913,6 @@ http2_transport_rx_callback (http_conn_t *hc)
       http_io_ts_drain (hc, HTTP2_FRAME_HEADER_SIZE);
       to_deq -= fh.length;
 
-      /* to prevent data leakage */
-      if (to_deq && to_deq < HTTP2_FRAME_HEADER_SIZE)
-       {
-         HTTP_DBG (1, "to_deq %u is less than frame header size", to_deq);
-#if HTTP_DEBUG
-         u8 *tmp = 0;
-         vec_validate (tmp, to_deq - 1);
-         http_io_ts_read (hc, tmp, to_deq, 0);
-         clib_warning ("%U", format_hex_bytes, tmp, to_deq);
-#endif
-         http2_connection_error (hc, HTTP2_ERROR_PROTOCOL_ERROR, 0);
-         return;
-       }
-
       HTTP_DBG (1, "frame type 0x%02x len %u", fh.type, fh.length);
 
       if ((h2c->flags & HTTP2_CONN_F_EXPECT_CONTINUATION) &&
@@ -2973,6 +2952,14 @@ http2_transport_rx_callback (http_conn_t *hc)
          rv = http2_handle_goaway_frame (hc, &fh);
          break;
        case HTTP2_FRAME_TYPE_PING:
+         /* to prevent information leakage, PING frames can be sent from any
+          * endpoint and is expected to be sent with higher priority */
+         if (to_deq && to_deq < HTTP2_FRAME_HEADER_SIZE)
+           {
+             HTTP_DBG (1, "to_deq %u is less than frame header size", to_deq);
+             http2_connection_error (hc, HTTP2_ERROR_PROTOCOL_ERROR, 0);
+             return;
+           }
          rv = http2_handle_ping_frame (hc, &fh);
          break;
        case HTTP2_FRAME_TYPE_CONTINUATION: