1529830 - Empty http2 DATA frame with END_STREAM flag cause GoAway Internal Error

Status: NEW

(Core :: Networking: HTTP, defect, P3)

Description

[xpahos]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36

Steps to reproduce:

Start sending DATA frames to Firefox without END_FRAME flag. On the end send empty DATA frame with END_FRAME flag.

Actual results:

Firefox will respond with GoAway INTERNALL_ERROR == 2

Expected results:

Two flow-control windows are applicable: the stream flow-control window and the connection flow-control window. The sender MUST NOT send a flow-controlled frame with a length that exceeds the space available in either of the flow-control windows advertised by the receiver. Frames with zero length with the END_STREAM flag set (that is, an empty DATA frame) MAY be sent if there is no available space in either flow-control window.

https://http2.github.io/http2-spec/

Comment 1

[xpahos]

Looks like nsHttpTransaction::HandleContent in nsHttpTransaction.cpp is setting mTransactionDone = true; without checking END_STREAM flag. When receiving the next empty DATA frame with END_STREAM nsHttpTransaction::WriteSegments checks if mTransactionDone and returns NS_BASE_STREAM_CLOSED.

Comment 2

[Valentin Gosu [:valentin] {{ PTO 2 - 12 April }}]

Dragana, do you have time to look into it?

Comment 3

[Dragana Damjanovic [:dragana]]

do you have and test for this that I can reptroduse it?

Although I think I know what is going on.

Comment 4

[xpahos]

(In reply to Dragana Damjanovic [:dragana] from comment #3)

do you have and test for this that I can reptroduse it?

Although I think I know what is going on.

Unfortunately, we already changed behaviour on our production environment and I don't have a server with external access. Which HTTP server do you use for testing?

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Clear a needinfo that is pending on an inactive user.

Inactive users most likely will not respond; if the missing information is essential and cannot be collected another way, the bug maybe should be closed as INCOMPLETE.

For more information, please visit BugBot documentation.