diff --git a/backport-Fix-H2-debug-message-for-a-rate-limit.patch b/backport-Fix-H2-debug-message-for-a-rate-limit.patch new file mode 100644 index 0000000000000000000000000000000000000000..38e04ee045a53e810f386ed8336d99b65f9a156b --- /dev/null +++ b/backport-Fix-H2-debug-message-for-a-rate-limit.patch @@ -0,0 +1,26 @@ +From ed04f369793c81d04b625990305a84ef9fb512f6 Mon Sep 17 00:00:00 2001 +From: Masakazu Kitajo +Date: Tue, 17 Oct 2023 03:34:37 +0900 +Subject: [PATCH] Fix H2 debug message for a rate limit (#10583) (#10622) + +(cherry picked from commit a8efca589716168a9c9cb32a74ddcb0915d59f7f) + + Conflicts: + proxy/http2/Http2ConnectionState.cc +--- + proxy/http2/Http2ConnectionState.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/proxy/http2/Http2ConnectionState.cc b/proxy/http2/Http2ConnectionState.cc +index 675cdbc4358..df506c6d18d 100644 +--- a/proxy/http2/Http2ConnectionState.cc ++++ b/proxy/http2/Http2ConnectionState.cc +@@ -545,7 +545,7 @@ rcv_rst_stream_frame(Http2ConnectionState &cstate, const Http2Frame &frame) + cstate.get_received_rst_stream_frame_count() > cstate.configured_max_rst_stream_frames_per_minute) { + HTTP2_INCREMENT_THREAD_DYN_STAT(HTTP2_STAT_MAX_RST_STREAM_FRAMES_PER_MINUTE_EXCEEDED, this_ethread()); + Http2StreamDebug(cstate.session, stream_id, "Observed too frequent RST_STREAM frames: %u frames within a last minute", +- cstate.get_received_settings_frame_count()); ++ cstate.get_received_rst_stream_frame_count()); + return Http2Error(Http2ErrorClass::HTTP2_ERROR_CLASS_CONNECTION, Http2ErrorCode::HTTP2_ERROR_ENHANCE_YOUR_CALM, + "reset too frequent RST_STREAM frames"); + } diff --git a/backport-Fixed-h2spec-6.4.3-test.patch b/backport-Fixed-h2spec-6.4.3-test.patch new file mode 100644 index 0000000000000000000000000000000000000000..2235e9f2f26b849a52238dac8aefc0b476b6377a --- /dev/null +++ b/backport-Fixed-h2spec-6.4.3-test.patch @@ -0,0 +1,50 @@ +From fd8d4130b6ce7eb01d69e000c38d3e4bf8b69a69 Mon Sep 17 00:00:00 2001 +From: Masakazu Kitajo +Date: Tue, 17 Oct 2023 03:29:57 +0900 +Subject: [PATCH] Fixed h2spec 6.4.3 test (#10584) (#10621) + +Should respond with FRAME_SIZE_ERROR when receiving reset frame of +incorrect size before looking to see if the stream exists. + +(cherry picked from commit bb951e905e7844f304e6635a84acbd0734aed251) + + Conflicts: + proxy/http2/Http2ConnectionState.cc + +Co-authored-by: Bryan Call +--- + proxy/http2/Http2ConnectionState.cc | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/proxy/http2/Http2ConnectionState.cc b/proxy/http2/Http2ConnectionState.cc +index dcfab9b6747..675cdbc4358 100644 +--- a/proxy/http2/Http2ConnectionState.cc ++++ b/proxy/http2/Http2ConnectionState.cc +@@ -521,6 +521,13 @@ rcv_rst_stream_frame(Http2ConnectionState &cstate, const Http2Frame &frame) + "reset access stream with invalid id"); + } + ++ // A RST_STREAM frame with a length other than 4 octets MUST be treated ++ // as a connection error (Section 5.4.1) of type FRAME_SIZE_ERROR. ++ if (frame.header().length != HTTP2_RST_STREAM_LEN) { ++ return Http2Error(Http2ErrorClass::HTTP2_ERROR_CLASS_CONNECTION, Http2ErrorCode::HTTP2_ERROR_FRAME_SIZE_ERROR, ++ "reset frame wrong length"); ++ } ++ + Http2Stream *stream = cstate.find_stream(stream_id); + if (stream == nullptr) { + if (cstate.is_valid_streamid(stream_id)) { +@@ -531,13 +538,6 @@ rcv_rst_stream_frame(Http2ConnectionState &cstate, const Http2Frame &frame) + } + } + +- // A RST_STREAM frame with a length other than 4 octets MUST be treated +- // as a connection error (Section 5.4.1) of type FRAME_SIZE_ERROR. +- if (frame.header().length != HTTP2_RST_STREAM_LEN) { +- return Http2Error(Http2ErrorClass::HTTP2_ERROR_CLASS_CONNECTION, Http2ErrorCode::HTTP2_ERROR_FRAME_SIZE_ERROR, +- "reset frame wrong length"); +- } +- + // Update RST_STREAM frame count per minute + cstate.increment_received_rst_stream_frame_count(); + // Close this connection if its RST_STREAM frame count exceeds a limit diff --git a/trafficserver.spec b/trafficserver.spec index b917089679914c3502eca2388344e925d55d5e5d..1a4d46afafbc83f274a14b0fc58ba5b82d09426e 100644 --- a/trafficserver.spec +++ b/trafficserver.spec @@ -1,7 +1,7 @@ %define _hardened_build 1 Name: trafficserver Version: 9.2.3 -Release: 3 +Release: 4 Summary: Apache Traffic Server, a reverse, forward and transparent HTTP proxy cache License: Apache-2.0 URL: https://trafficserver.apache.org/ @@ -13,6 +13,9 @@ Patch0003: config-layout-openEuler.patch Patch0004: Modify-storage.config-for-traffic_cache_tool.patch Patch0005: add-riscv-support.patch Patch0006: CVE-2024-31309.patch +Patch0007: backport-Fixed-h2spec-6.4.3-test.patch +Patch0008: backport-Fix-H2-debug-message-for-a-rate-limit.patch + BuildRequires: expat-devel hwloc-devel openssl-devel pcre-devel zlib-devel xz-devel BuildRequires: libcurl-devel ncurses-devel gcc gcc-c++ perl-ExtUtils-MakeMaker BuildRequires: libcap-devel cmake libunwind-devel automake chrpath @@ -133,6 +136,10 @@ getent passwd ats >/dev/null || useradd -r -u 176 -g ats -d / -s /sbin/nologin - %{_datadir}/pkgconfig/trafficserver.pc %changelog +* Mon Jul 15 2024 zhangxingrong- - 9.2.3-4 +- Fixed h2spec 6.4.3 test +- Fix H2 debug message for a rate limit + * Thu May 30 2024 laokz - 9.2.3-3 - Update riscv64 patch