From afefbda518b0685136840a5c7d0e59976176b582 Mon Sep 17 00:00:00 2001
From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
Date: Fri, 17 May 2019 22:47:54 +0900
Subject: [PATCH] Ignore content-length in 200 response to CONNECT request

---
 lib/nghttp2_http.c           |  9 ++++++---
 tests/nghttp2_session_test.c | 27 ++++++++++++++++++++++-----
 2 files changed, 28 insertions(+), 8 deletions(-)

diff --git a/lib/nghttp2_http.c b/lib/nghttp2_http.c
index 6e8acfdc..8d990299 100644
--- a/lib/nghttp2_http.c
+++ b/lib/nghttp2_http.c
@@ -263,11 +263,14 @@ static int http_response_on_header(nghttp2_stream *stream, nghttp2_hd_nv *nv,
       stream->content_length = 0;
       return NGHTTP2_ERR_REMOVE_HTTP_HEADER;
     }
-    if (stream->status_code / 100 == 1 ||
-        (stream->status_code / 100 == 2 &&
-         (stream->http_flags & NGHTTP2_HTTP_FLAG_METH_CONNECT))) {
+    if (stream->status_code / 100 == 1) {
       return NGHTTP2_ERR_HTTP_HEADER;
     }
+    /* https://tools.ietf.org/html/rfc7230#section-3.3.3 */
+    if (stream->status_code / 100 == 2 &&
+        (stream->http_flags & NGHTTP2_HTTP_FLAG_METH_CONNECT)) {
+      return NGHTTP2_ERR_REMOVE_HTTP_HEADER;
+    }
     if (stream->content_length != -1) {
       return NGHTTP2_ERR_HTTP_HEADER;
     }
diff --git a/tests/nghttp2_session_test.c b/tests/nghttp2_session_test.c
index 09f7576b..d1420473 100644
--- a/tests/nghttp2_session_test.c
+++ b/tests/nghttp2_session_test.c
@@ -11762,6 +11762,8 @@ void test_nghttp2_http_ignore_content_length(void) {
   const nghttp2_nv conn_reqnv[] = {MAKE_NV(":authority", "localhost"),
                                    MAKE_NV(":method", "CONNECT"),
                                    MAKE_NV("content-length", "999999")};
+  const nghttp2_nv conn_cl_resnv[] = {MAKE_NV(":status", "200"),
+                                      MAKE_NV("content-length", "0")};
   nghttp2_stream *stream;
 
   mem = nghttp2_mem_default();
@@ -11791,6 +11793,24 @@ void test_nghttp2_http_ignore_content_length(void) {
 
   nghttp2_bufs_reset(&bufs);
 
+  /* Content-Length in 200 response to CONNECT is ignored */
+  stream = open_sent_stream2(session, 3, NGHTTP2_STREAM_OPENING);
+  stream->http_flags |= NGHTTP2_HTTP_FLAG_METH_CONNECT;
+
+  rv = pack_headers(&bufs, &deflater, 3, NGHTTP2_FLAG_END_HEADERS,
+                    conn_cl_resnv, ARRLEN(conn_cl_resnv), mem);
+  CU_ASSERT(0 == rv);
+
+  rv = nghttp2_session_mem_recv(session, bufs.head->buf.pos,
+                                nghttp2_buf_len(&bufs.head->buf));
+
+  CU_ASSERT((ssize_t)nghttp2_buf_len(&bufs.head->buf) == rv);
+
+  CU_ASSERT(NULL == nghttp2_session_get_next_ob_item(session));
+  CU_ASSERT(-1 == stream->content_length);
+
+  nghttp2_bufs_reset(&bufs);
+
   nghttp2_hd_deflate_free(&deflater);
   nghttp2_session_del(session);
 
@@ -11866,13 +11886,10 @@ void test_nghttp2_http_record_request_method(void) {
   CU_ASSERT((NGHTTP2_HTTP_FLAG_METH_CONNECT & stream->http_flags) > 0);
   CU_ASSERT(-1 == stream->content_length);
 
-  /* content-length is now allowed in 200 response to a CONNECT
-     request */
+  /* content-length is ignored in 200 response to a CONNECT request */
   item = nghttp2_session_get_next_ob_item(session);
 
-  CU_ASSERT(NULL != item);
-  CU_ASSERT(NGHTTP2_RST_STREAM == item->frame.hd.type);
-  CU_ASSERT(NGHTTP2_PROTOCOL_ERROR == item->frame.rst_stream.error_code);
+  CU_ASSERT(NULL == item);
 
   nghttp2_hd_deflate_free(&deflater);
   nghttp2_session_del(session);