From 0e231bbd7ca7b3f35c1358ef9145280db90a96b6 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Thu, 19 Mar 2026 07:11:54 +0100 Subject: [PATCH] BUG/MINOR: mux-h2: properly ignore R bit in GOAWAY stream ID The stream ID indicated in GOAWAY frames must have its bit 31 (R) ignored and this wasn't the case. The effect is that if this bit was present, the GOAWAY frame would mark the last acceptable stream as negative, which is the default situation (unlimited), thus would basically result in this GOAWAY frame to be ignored since it would replace a negative last_sid with another negative one. The impact is thus basically that if a peer would emit anything non-zero in the R bit, the GOAWAY frame would be ignored and new streams would still be initiated on the backend, before being rejected by the server. Thanks to Haruto Kimura (Stella) for finding and reporting this bug. This fix needs to be backported to all stable versions. --- src/mux_h2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mux_h2.c b/src/mux_h2.c index bfb02aa1d..09606ca39 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -3384,7 +3384,7 @@ static int h2c_handle_goaway(struct h2c *h2c) return 0; } - last = h2_get_n32(&h2c->dbuf, 0); + last = h2_get_n32(&h2c->dbuf, 0) & 0x7FFFFFFF; // mask R bit h2c->errcode = h2_get_n32(&h2c->dbuf, 4); if (h2c->last_sid < 0) h2c->last_sid = last;