mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-12-02 20:09:01 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

SPDY: consistently handle control frames with unknown type.

Browse Source 
The SPDY draft 2 specification requires that if an endpoint receives a
control frame for a type it does not recognize, it must ignore the frame.
But the 3 and 3.1 drafts don't seem to declare any behavior for such case.
Then sticking with the previous draft in this matter looks to be right.

But previously, only 8 least significant bits of the type field were
parsed while the rest of 16 bits of the field were checked against zero.
Though there are no known frame types bigger than 255, this resulted in
inconsistency in handling of such frames: they were not recognized as
valid frames at all, and the connection was closed.
This commit is contained in:
Valentin Bartenev 2014-04-07 19:27:56 +04:00
parent 108e4d94e4
commit a547f4ac15
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/http/ngx_http_spdy.c
View File

@ -47,11 +47,11 @@
#define ngx_spdy_ctl_frame_check(h) \
(((h) & 0xffffff00) == ngx_spdy_ctl_frame_head(0))
(((h) & 0xffff0000) == ngx_spdy_ctl_frame_head(0))
#define ngx_spdy_data_frame_check(h) \
(!((h) & (uint32_t) NGX_SPDY_CTL_BIT << 31))
#define ngx_spdy_ctl_frame_type(h) ((h) & 0x000000ff)
#define ngx_spdy_ctl_frame_type(h) ((h) & 0x0000ffff)
#define ngx_spdy_frame_flags(p) ((p) >> 24)
#define ngx_spdy_frame_length(p) ((p) & 0x00ffffff)
#define ngx_spdy_frame_id(p) ((p) & 0x00ffffff)
@ -837,6 +837,7 @@ ngx_http_spdy_state_head(ngx_http_spdy_connection_t *sc, u_char *pos,
u_char *end)
{
uint32_t head, flen;
ngx_uint_t type;
if (end - pos < NGX_SPDY_FRAME_HEADER_SIZE) {
return ngx_http_spdy_state_save(sc, pos, end,
@ -859,7 +860,9 @@ ngx_http_spdy_state_head(ngx_http_spdy_connection_t *sc, u_char *pos,
head, sc->flags, sc->length);
if (ngx_spdy_ctl_frame_check(head)) {
switch (ngx_spdy_ctl_frame_type(head)) {
type = ngx_spdy_ctl_frame_type(head);
switch (type) {
case NGX_SPDY_SYN_STREAM:
return ngx_http_spdy_state_syn_stream(sc, pos, end);
@ -885,7 +888,9 @@ ngx_http_spdy_state_head(ngx_http_spdy_connection_t *sc, u_char *pos,
case NGX_SPDY_WINDOW_UPDATE:
return ngx_http_spdy_state_window_update(sc, pos, end);
default: /* TODO logging */
default:
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0,
"spdy control frame with unknown type %ui", type);
return ngx_http_spdy_state_skip(sc, pos, end);
}
}