758625 - 0 length spdy responses not always terminated properly

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Patrick McManus [:mcmanus]]

Our friends at webtide (makers of jetty) reported this.

a spdy stream with a fin on the syn-reply might not have its termination detected if the http data in the syn-reply does not also signal that there is no body (e.g. via a content-length: 0 or by using a response code that is defined to have no body like 304).

this can be worked around on the server side by either including a content-length:0 or by placing the fin on a 0 length data frame instead of directly on the syn-reply.

Fixing it is just a matter of applying the same mNeedsCleanup flag that data frame processing uses for signaling EOF to the http layer.

Comment 1

[Patrick McManus [:mcmanus]]

Attachment: patch 0

Comment 2

[Honza Bambas (:mayhemer)]

Comment on attachment 627231 [details] [diff] [review]
patch 0

Review of attachment 627231 [details] [diff] [review]:
-----------------------------------------------------------------

::: netwerk/protocol/http/SpdySession.cpp
@@ +2042,5 @@
> +  NS_ABORT_IF_FALSE(!mNeedsCleanup, "mNeedsCleanup unexpectedly set");
> +  mNeedsCleanup = mInputFrameDataStream;
> +
> +  *aCountWritten = 0;
> +  ResetDownstreamState();

Please let *aCountWritten = 0; be set explicitly outside this method (by the caller).

Comment 3

[Patrick McManus [:mcmanus]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/004e123be159

(checkin comment has wrong bug number 758725)

Comment 4

[Patrick McManus [:mcmanus]]

Comment on attachment 627231 [details] [diff] [review]
patch 0

[Approval Request Comment]
Bug caused by (feature/regressing bug #):  original spdy bug

User impact if declined: 
interop problem with compliant spdy/2 servers.. just discovered in the devlopment of a new server. we risk problems with other emerging servers in a fast moving space by not fixing.

Testing completed (on m-c, etc.): 
on m-c

Risk to taking this patch (and alternatives if risky):  low.. the path it uses is already used on data frames, this allows control frames to trigger the same code

Comment 5

[Patrick McManus [:mcmanus]]

https://hg.mozilla.org/mozilla-central/rev/004e123be159

Comment 6

[Alex Keybl [:akeybl]]

Comment on attachment 627231 [details] [diff] [review]
patch 0

[Triage Comment]
Approved for Aurora 14 for sake of compatibility given the low risk evaluation.

Comment 7

[Patrick McManus [:mcmanus]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/210ca2935a9a