Skip to content

Conversation

@MegaManSec
Copy link
Contributor

This PR fixes three robustness issues in the HTTP/3 (ngtcp2/nghttp3) path:

Stream leak on submit failure
After successfully opening a QUIC bidi stream, if nghttp3_conn_submit_request() fails, the code left the QUIC stream open. We now call cf_ngtcp2_stream_close() to cancel the just-opened stream and flush egress, preventing a leaked stream on the wire. Note: used_bidi_streams remains monotonic by design and is not decremented.

Incorrect stream marked as QUIC-flow-blocked
When ngtcp2_conn_writev_stream() returns NGTCP2_ERR_STREAM_DATA_BLOCKED, the code previously marked quic_flow_blocked on the transfer associated with x->data, which may not correspond to stream_id. We now look up the correct Curl_easy via ngtcp2_conn_get_stream_user_data(stream_id), mark that stream’s context, and nudge the multi with Curl_multi_mark_dirty().

Undefined error returned from nghttp3 callback
cb_h3_recv_header() returned -1 on errors, which is not a defined nghttp3 error code. We now return NGHTTP3_ERR_CALLBACK_FAILURE so nghttp3 can correctly classify and handle the failure.

Note: These patches were created with LLMs.

@github-actions github-actions bot added the HTTP/3 h3 or quic related label Oct 7, 2025
@bagder bagder requested a review from icing October 7, 2025 06:05
@icing
Copy link
Contributor

icing commented Oct 7, 2025

The function ngtcp2_conn_get_stream_user_data() does not exist. Maybe the LLM wishes it to?

I agree with the fix to report NGTCP2_ERR_STREAM_DATA_BLOCKED on the correct stream, but the lookup from stream_id to data is currently not there. We would need to either add another hash (meh) or iterate over the stream hash to find the mid and get the data that way.

@MegaManSec
Copy link
Contributor Author

The function ngtcp2_conn_get_stream_user_data() does not exist. Maybe the LLM wishes it to?

Indeed:) Sorry, I submitted this PR, saw it failed, then have had 0 free time to correct it.

@MegaManSec
Copy link
Contributor Author

@icing It would probably be best if ddfe8ff is reverted and somebody else works on a fix for this bug, right? If so, lmk and I will force-push a removal of this commit -- please open an issue (or if you are able to start on a patch asap, then just a pr) for this bug.

@icing
Copy link
Contributor

icing commented Oct 7, 2025

ddfe8ff

Agreed. Revert that change and the PR looks fine to me. Could you open a short issue about the needed fix in the block handling? Just so it does not get lost.

@MegaManSec
Copy link
Contributor Author

Done; #18905

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

HTTP/3 h3 or quic related

Development

Successfully merging this pull request may close these issues.

2 participants