From b74b5289c8ab27002700416974867edc2ae0676c Mon Sep 17 00:00:00 2001
From: Christopher Faulet <cfaulet@haproxy.com>
Date: Tue, 19 May 2026 11:15:38 +0200
Subject: [PATCH] BUG/MINOR: h1: Don't mask websocket protocol if multiple
 protocols used

During H1 message parsing, the Upgrade header values are checked to detect
"websocket" prototol, to properly handle websocket upgrades between H1 and
H2 and to possibly reject messages if mandatory headers are missing.

However, the flag is reset for each new Upgrade header and the information
may be lost. So never reset it.

This patch must be backported as far as 2.4.
---
 reg-tests/http-messaging/websocket.vtc | 15 ++++++++++++++-
 src/h1.c                               |  2 --
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/reg-tests/http-messaging/websocket.vtc b/reg-tests/http-messaging/websocket.vtc
index 9567ea577..3990ddb9a 100644
--- a/reg-tests/http-messaging/websocket.vtc
+++ b/reg-tests/http-messaging/websocket.vtc
@@ -146,7 +146,7 @@ client c1 -connect ${hap_fe1_sock} {
 } -run
 
 # missing websocket key
-client c2 -connect ${hap_fe1_sock} {
+client c2_1 -connect ${hap_fe1_sock} {
 	txreq \
 	  -req "GET" \
 	  -url "/" \
@@ -158,6 +158,19 @@ client c2 -connect ${hap_fe1_sock} {
 	expect resp.status == 400
 } -run
 
+client c2_2 -connect ${hap_fe1_sock} {
+	txreq \
+	  -req "GET" \
+	  -url "/" \
+	  -hdr "host: 127.0.0.1" \
+	  -hdr "connection: upgrade" \
+	  -hdr "upgrade: proto1, websocket, proto2" \
+	  -hdr "upgrade: proto3"
+
+	rxresp
+	expect resp.status == 400
+} -run
+
 # missing key on server side
 client c3 -connect ${hap_fe2_sock} {
 	txreq \
diff --git a/src/h1.c b/src/h1.c
index 792737c9e..4ea759191 100644
--- a/src/h1.c
+++ b/src/h1.c
@@ -281,8 +281,6 @@ void h1_parse_upgrade_header(struct h1m *h1m, struct ist *value)
 	char *e, *n, *p;
 	struct ist word;
 
-	h1m->flags &= ~H1_MF_UPG_WEBSOCKET;
-
 	word.ptr = value->ptr - 1; // -1 for next loop's pre-increment
 	p = value->ptr;
 	e = value->ptr + value->len;