Skip to content

Ws over h2 pmd fixes - #3637

Open
thefallentree wants to merge 44 commits into
warmcat:mainfrom
thefallentree:ws-over-h2-pmd-fixes
Open

Ws over h2 pmd fixes#3637
thefallentree wants to merge 44 commits into
warmcat:mainfrom
thefallentree:ws-over-h2-pmd-fixes

Conversation

@thefallentree

@thefallentree thefallentree commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

ws-over-h2: permessage-deflate short return + ext tx-drain wedge

lws-team and others added 30 commits July 18, 2026 18:42
Basic h.264 / h.265 mkv / mp4 serving to view in browser
quic-version-negotiation

qir-last-tests

xr-29

qir-l1-fix

sai: QIR with QIR_LWS_BRANCH
fixes-1
lws_system_parse_policy() is compiled whenever LWS_WITH_NETWORK &&
LWS_WITH_FILE_OPS, but it is implemented with the LEJP JSON parser and
referenced lejp_construct()/lejp_parse()/lejp_destruct() unconditionally.

Callers such as the versioned-cert / ACME rotation path in tls.c (gated only on
LWS_WITH_DIR + LWS_WITH_NETWORK + LWS_WITH_FILE_OPS) do not gate on
LWS_WITH_LEJP, so a build with LWS_WITH_LEJP=OFF fails to link with undefined
lejp_* symbols.

Gate the JSON-parsing implementation on LWS_WITH_LEJP and provide a stub that
reports "no policy" (returns nonzero, *_policy = NULL) when LEJP is disabled.
Existing callers already treat a nonzero return as "no policy available", so
they continue to link and behave correctly without a JSON parser.
When a client mux (h2/h3) connection goes idle between transactions it sits in
LRS_IDLING.  On reusing it for a new stream, lws_vhost_active_conns() adopts
the new stream directly onto the network wsi but left it in LRS_IDLING.

LRS_IDLING does not carry LWSIFS_POCB, so lwsi_state_can_handle_POLLOUT() is
false for it and the network wsi's POLLOUT is never serviced: the child-walking
POLLOUT loop never runs, the new stream's HEADERS are never sent
(lws_h2_client_handshake() is never reached), and its response is never read.
The request just hangs.

Put the revived connection back into LRS_ESTABLISHED (the state it uses while
actively muxing) and clear the keep-warm idle timeout, so its POLLOUT is
serviced and the queued stream's headers go out.  Same fix for the h3/quic
branch.
…ring accept

If wsi->told_event_loop_closed was set during a manual close, eg
lws_libuv_closehandle() or elops_close_handle_manually_uv(), it would
remain set even if the wsi is re-used.  This causes SSL timeout issues
and fd leaks with HTTP -> HTTPS client redirects.

Clear wsi->told_event_loop_closed in elops_accept_uv(), to prevent this issue
on wsi re-use.  It's harmless on a new connection.
When handling LMQCPP_PUBACK_PROPERTIES_LEN_VBI/COMPLETED

This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
@thefallentree

Copy link
Copy Markdown
Contributor Author

I am sorry — it was just squashed from previous commits. Nothing new

@thefallentree

Copy link
Copy Markdown
Contributor Author

Actually this is a follow up fix for the commits you merged

@sonarqubecloud

Copy link
Copy Markdown

@lws-team

Copy link
Copy Markdown
Member

So for what I have on _temp branch, trying to add what you have on your branch now - d4e6802 - gives an empty patch. So I think I am up to date. I will push all this to main later today

@lws-team
lws-team force-pushed the main branch 22 times, most recently from 558a432 to 4e59faf Compare July 27, 2026 20:02
@lws-team
lws-team force-pushed the main branch 2 times, most recently from feb2be6 to b1c687c Compare August 5, 2026 14:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants