validate_client_resp: Limit this to esi_level == 0

There is no need to validate client response headers that we do not intend to transmit.
varnishcache · Sep 1, 2023 · 197e134 · 197e134
1 parent bf24404
commit 197e134
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/bin/varnishd/cache/cache_req_fsm.c b/bin/varnishd/cache/cache_req_fsm.c
@@ -235,7 +235,8 @@ cnt_deliver(struct worker *wrk, struct req *req)
 	VCL_deliver_method(req->vcl, wrk, req, NULL, NULL);
 
 	if (FEATURE(FEATURE_VALIDATE_CLIENT_RESPONSES) &&
-	    wrk->vpi->handling == VCL_RET_DELIVER && HTTP_ValidateResp(req->resp)) {
+	    req->esi_level == 0 && wrk->vpi->handling == VCL_RET_DELIVER &&
+	    HTTP_ValidateResp(req->resp)) {
 		VSLb(req->vsl, SLT_VCL_Error,
 		    "Response failed HTTP validation");
 		wrk->vpi->handling = VCL_RET_FAIL;
@@ -338,7 +339,8 @@ cnt_synth(struct worker *wrk, struct req *req)
 	AZ(VSB_finish(synth_body));
 
 	if (FEATURE(FEATURE_VALIDATE_CLIENT_RESPONSES) &&
-	    wrk->vpi->handling == VCL_RET_DELIVER && HTTP_ValidateResp(req->resp)) {
+	    req->esi_level == 0 && wrk->vpi->handling == VCL_RET_DELIVER &&
+	    HTTP_ValidateResp(req->resp)) {
 		VSLb(req->vsl, SLT_VCL_Error,
 		    "Synthetic response failed HTTP validation");
 		wrk->vpi->handling = VCL_RET_FAIL;