http: improve buffer reuse for heeaders, and discard unused bodies

The body content not being consumed was leading to misparses, where
we consumed body data as if it were a request. When mixed with proxies
this could lead to a security problem where the following request
content submitted from a different client winds up as stolen request
body content.

This also ensures we actually deliver errors to clients without
prematurely closing the connection.  (There are still problems
where the connection may be closed prematurely for an overlarge
header.)

1 files changed, 0 insertions, 2 deletions

diff --git a/src/supplemental/http/http_client.c b/src/supplemental/http/http_client.c
index 7062ae3c..4622dd94 100644
--- a/src/supplemental/http/http_client.c
+++ b/src/supplemental/http/http_client.c
@@ -217,7 +217,6 @@ typedef struct http_txn {
 	nni_list         aios; // upper level aio(s) -- maximum one
 	nni_http_client *client;
 	nni_http_conn   *conn;
-	nni_http_req    *req;
 	nni_http_res    *res;
 	nni_http_chunks *chunks;
 	http_txn_state   state;
@@ -398,7 +397,6 @@ nni_http_transact_conn(nni_http_conn *conn, nni_aio *aio)
 	nni_aio_list_init(&txn->aios);
 	txn->client = NULL;
 	txn->conn   = conn;
-	txn->req    = nni_http_conn_req(conn);
 	txn->res    = nni_http_conn_res(conn);
 	txn->state  = HTTP_SENDING;