[6.0] 85ce04463 Fix cache_req_body handling for H/2 requests

[Dridi Boukelmoune]

commit 85ce04463277f75647caa5b1a0d7b5c3dc7d3606
Author: Dag Haavi Finstad <daghf at varnish-software.com>
Date:   Fri May 18 14:35:40 2018 +0200

    Fix cache_req_body handling for H/2 requests
    
    The h/2 request body VFP would drop data when the input buffer was too
    small to fit the data in the received frame.
    
    With this fix we have the VFP code call us again with a fresh buffer
    when we run out.
    
    Fixes: #2679

diff --git a/bin/varnishd/http2/cache_http2_proto.c b/bin/varnishd/http2/cache_http2_proto.c
index 6a0c92be5..1da101a0e 100644
--- a/bin/varnishd/http2/cache_http2_proto.c
+++ b/bin/varnishd/http2/cache_http2_proto.c
@@ -770,6 +770,12 @@ h2_vfp_body(struct vfp_ctx *vc, struct vfp_entry *vfe, void *ptr, ssize_t *lp)
 			h2->rxf_len -= l;
 		}
 		*lp = l;
+		if (h2->rxf_len > 0) {
+			/* We ran out of storage: Have VFP call us
+			 * again with a fresh buffer */
+			Lck_Unlock(&h2->sess->mtx);
+			return (VFP_OK);
+		}
 		if (h2->rxf_len == 0) {
 			if (h2->rxf_flags & H2FF_DATA_END_STREAM)
 				retval = VFP_END;
diff --git a/bin/varnishtest/tests/r02679.vtc b/bin/varnishtest/tests/r02679.vtc
new file mode 100644
index 000000000..296ce9c29
--- /dev/null
+++ b/bin/varnishtest/tests/r02679.vtc
@@ -0,0 +1,31 @@
+varnishtest "#2679: H/2 rxbody vfp drops data"
+
+server s1 {
+	rxreq
+	expect req.http.content-length == "31469"
+	expect req.bodylen == 31469
+	txresp
+} -start
+
+varnish v1 -vcl+backend {
+	import std;
+	sub vcl_recv {
+#		std.cache_req_body(100KB);
+	}
+} -start
+
+varnish v1 -cliok "param.set feature +http2"
+
+client c1 {
+	stream 1 {
+		txreq -req POST -hdr "content-length" "31469" -nostrend
+		txdata -datalen 1550 -nostrend
+		rxwinup
+		txdata -datalen 16000 -nostrend
+		rxwinup
+		txdata -datalen 13919
+		rxwinup
+		rxresp
+		expect resp.status == 200
+	} -run
+} -run