From c78b7693abc1de4fa76d28ebf4c6ef9dcf0a68bb Mon Sep 17 00:00:00 2001 From: Michael Fraenkel Date: Mon, 9 Jul 2018 23:24:18 -0400 Subject: [PATCH] net/http: update bundled http2 Updates http2 to x/net/http2 git rev 292b43b for: http2: reject incoming HEADERS in Server on half-closed streams https://golang.org/cl/111677 Updates #25023 Change-Id: I479ae9b5b899fb0202e6301d02535fb6aeb4997a Reviewed-on: https://go-review.googlesource.com/122877 Reviewed-by: Brad Fitzpatrick Run-TryBot: Brad Fitzpatrick TryBot-Result: Gobot Gobot --- src/net/http/h2_bundle.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/net/http/h2_bundle.go b/src/net/http/h2_bundle.go index b62459ee80..2068a0dc76 100644 --- a/src/net/http/h2_bundle.go +++ b/src/net/http/h2_bundle.go @@ -5466,6 +5466,13 @@ func (sc *http2serverConn) processHeaders(f *http2MetaHeadersFrame) error { // processing this frame. return nil } + // RFC 7540, sec 5.1: If an endpoint receives additional frames, other than + // WINDOW_UPDATE, PRIORITY, or RST_STREAM, for a stream that is in + // this state, it MUST respond with a stream error (Section 5.4.2) of + // type STREAM_CLOSED. + if st.state == http2stateHalfClosedRemote { + return http2streamError(id, http2ErrCodeStreamClosed) + } return st.processTrailerHeaders(f) } -- 2.50.0