mod_http2: do not RST_STREAM header-only HTTP/2 responses

A mod_cache revalidation 304 (EOR + Flush, no body EOS) reaches
s_c2_done() with an output beam that is neither closed nor EOS'd, so
h2_beam_is_complete() reports it incomplete and s_c2_done() aborts it,
resetting the stream (the client sees "stream not closed cleanly"). But
a header-only response (204/304, and HEAD) is complete without a body
EOS.

Track response completeness in conn_ctx->response_eos_seen, set when an
EOS passes out (h2_c2_filter_out) or the response is header-only, and
spare such responses from the s_c2_done() abort. stream_data_cb()
already carries the same header-only exemption; this brings s_c2_done()
in line.

Adds test_h2_105_21: a mod_cache revalidation 304 must close cleanly.

Author: mmontalbo

modules/http2/h2_c2.c

@@ -397,6 +397,13 @@ static apr_status_t h2_c2_filter_out(ap_filter_t* f, apr_bucket_brigade* bb)
                 ap_bucket_response *resp = e->data;
                 if (resp->status >= HTTP_OK) {
                     conn_ctx->has_final_response = 1;
+                    if (AP_STATUS_IS_HEADER_ONLY(resp->status)) {
+                        /* A header-only response (204/304) is complete without
+                         * a body EOS; mark it complete so c2_process() does not
+                         * abort/reset it as an "incomplete" response (which
+                         * would re-open PR 69580). */
+                        conn_ctx->response_eos_seen = 1;
+                    }
                     break;
                 }
             }
@@ -406,6 +413,19 @@ static apr_status_t h2_c2_filter_out(ap_filter_t* f, apr_bucket_brigade* bb)
         }
     }
 #endif /* AP_HAS_RESPONSE_BUCKETS */
+    /* Note when the response body completes (an EOS passes out). A c2 that
+     * finishes WITHOUT having seen an EOS (e.g. the CGI/handler timed out
+     * mid-body) produced an incomplete response and must reset the stream. */
+    if (!conn_ctx->response_eos_seen) {
+        apr_bucket *e;
+        for (e = APR_BRIGADE_FIRST(bb); e != APR_BRIGADE_SENTINEL(bb);
+             e = APR_BUCKET_NEXT(e)) {
+            if (APR_BUCKET_IS_EOS(e)) {
+                conn_ctx->response_eos_seen = 1;
+                break;
+            }
+        }
+    }
     rv = beam_out(f->c, conn_ctx, bb);
 
     ap_log_cerror(APLOG_MARK, APLOG_TRACE2, rv, f->c,

modules/http2/h2_conn_ctx.h

@@ -60,6 +60,7 @@ struct h2_conn_ctx_t {
     apr_pollfd_t pfd;                /* c1: poll socket input, c2: NUL */
 
     int has_final_response;          /* final HTTP response passed on out */
+    int response_eos_seen;           /* c2: response body completed (EOS seen on out) */
     apr_status_t last_err;           /* APR_SUCCES or last error encountered in filters */
 
     apr_off_t bytes_sent;            /* c2: bytes acutaly sent via c1 */

modules/http2/h2_mplx.c

@@ -1005,7 +1005,14 @@ static void s_c2_done(h2_mplx *m, conn_rec *c2, h2_conn_ctx_t *conn_ctx)
         if (conn_ctx->beam_out)
           h2_beam_abort(conn_ctx->beam_out, c2);
     }
-    else if (!conn_ctx->beam_out || !h2_beam_is_complete(conn_ctx->beam_out)) {
+    else if (!conn_ctx->beam_out
+             || (!h2_beam_is_complete(conn_ctx->beam_out)
+                 && !conn_ctx->response_eos_seen)) {
+        /* h2_beam_is_complete() cannot tell a header-only response (204/304,
+         * legitimately no body EOS) from a truncated one. response_eos_seen is
+         * set when an EOS passed out OR the response was header-only, so spare
+         * those here; only abort genuinely incomplete output. Without this, a
+         * body-less mod_cache 304 revalidation gets RST_STREAM'd. */
         ap_log_cerror(APLOG_MARK, APLOG_TRACE1, conn_ctx->last_err, c2,
                       "h2_c2(%s-%d): processing finished with incomplete output",
                       conn_ctx->id, conn_ctx->stream_id);

test/modules/http2/test_105_timeout.py

@@ -1,5 +1,6 @@
 import socket
 import time
+from datetime import timedelta
 
 import pytest
 
@@ -164,3 +165,36 @@ def test_h2_105_12(self, env):
         piper.close()
         assert piper.response, f'{piper}'
         assert piper.response['status'] == 408, f"{piper.response}"
+
+    # A body-less response that is missing an EOS
+    # must NOT be reset over HTTP/2. mod_cache revalidation of a cached,
+    # immediately-stale resource emits exactly such a 304 (EOR + Flush, no EOS).
+    # This guards the incomplete-response reset against re-opening PR 69580:
+    # only a response that began a body and is missing EOS should be
+    # reset, never a header-only one.
+    def test_h2_105_21(self, env):
+        cacheroot = f"{env.server_dir}/cacheroot"
+        env.mkpath(cacheroot)
+        conf = H2Conf(env)
+        conf.add(f"""
+            CacheRoot "{cacheroot}"
+            CacheEnable disk /
+            Header set Cache-Control "public, max-age=0"
+            """)
+        conf.add_vhost_test1()
+        conf.install()
+        assert env.apache_restart() == 0
+        url = env.mkurl("https", "test1", "/006/006.css")
+        # prime the cache (stored, immediately stale via max-age=0)
+        r = env.curl_get(url)
+        assert r.exit_code == 0, f'{r}'
+        assert r.response["status"] == 200
+        lm = r.response["header"]["last-modified"]
+        # revalidate: mod_cache freshens the stale entry and the origin returns a
+        # body-less 304. The h2 stream must close cleanly; a regression shows up
+        # as a curl exit (92, "stream not closed cleanly"), not as a 304.
+        for _ in range(5):
+            r = env.curl_get(url, options=["-H", "Cache-Control: max-age=0",
+                                           "-H", f"if-modified-since: {lm}"])
+            assert r.exit_code == 0, f'304 stream was reset (curl {r.exit_code}): {r}'
+            assert r.response["status"] == 304, f'{r.response}'