[master] c8bfae704 Decline DATA frames after seeing END_STREAM

[Dag Haavi Finstad]

commit c8bfae704dcb25002daaf5206d5b4c1a9b7cf753
Author: Dag Haavi Finstad <daghf at varnish-software.com>
Date:   Tue Jun 19 15:40:03 2018 +0200

    Decline DATA frames after seeing END_STREAM
    
    If a client mistakenly sent a DATA frame on a stream where it already
    transmitted an END_STREAM, it would lead to the rxthread sitting around
    indefinitely.
    
    Big thanks to @xcir for his help in diagnosing this.
    
    Fixes: #2623

diff --git a/bin/varnishd/http2/cache_http2_proto.c b/bin/varnishd/http2/cache_http2_proto.c
index 7001b60fc..d10f00df2 100644
--- a/bin/varnishd/http2/cache_http2_proto.c
+++ b/bin/varnishd/http2/cache_http2_proto.c
@@ -726,6 +726,12 @@ h2_rx_data(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
 	ASSERT_RXTHR(h2);
 	if (r2 == NULL || !r2->scheduled)
 		return (0);
+	if (r2->req->req_body_status == REQ_BODY_NONE) {
+		/* state REQ_BODY_NONE implies we already received an
+		 * END_STREAM.  */
+		r2->error = H2SE_STREAM_CLOSED;
+		return (H2SE_STREAM_CLOSED); // rfc7540,l,1766,1769
+	}
 	Lck_Lock(&h2->sess->mtx);
 	AZ(h2->mailcall);
 	h2->mailcall = r2;
diff --git a/bin/varnishtest/tests/t02014.vtc b/bin/varnishtest/tests/t02014.vtc
index bc49f4e84..db72566db 100644
--- a/bin/varnishtest/tests/t02014.vtc
+++ b/bin/varnishtest/tests/t02014.vtc
@@ -1,6 +1,6 @@
 varnishtest "Exercise h/2 sender flow control code"
 
-barrier b1 sock 3
+barrier b1 sock 3 -cyclic
 
 server s1 {
 	rxreq
@@ -45,3 +45,19 @@ client c1 {
 
 	stream 0 -wait
 } -run
+
+client c1 {
+	stream 0 {
+		barrier b1 sync
+	} -start
+
+	stream 1 {
+		txreq
+		txdata -data "fail"
+		rxrst
+		expect rst.err == STREAM_CLOSED
+		barrier b1 sync
+	} -run
+
+	stream 0 -wait
+} -run