Reject requests with unrecognized transfer encodings

This fixes https://github.com/graygnuorg/pound/issues/25.

* src/http.c (do_http): Disallow unrecognized transfer encodings.
* tests/invenc.at: New test case.
* tests/Makefile.am: Add new test.
* tests/testsuite.at: Likewise.

src/http.c

@@ -4585,13 +4585,21 @@ do_http (POUND_HTTP *phttp)
       /*
        * check for possible request smuggling attempt
        */
-      if (transfer_encoding != TRANSFER_ENCODING_NONE &&
-	  content_length != NO_CONTENT_LENGTH)
+      if (transfer_encoding != TRANSFER_ENCODING_NONE)
 	{
-	  log_error (phttp, HTTP_STATUS_BAD_REQUEST, 0,
-		     "both Transfer-Encoding and Content-Length given");
-	  http_err_reply (phttp, HTTP_STATUS_BAD_REQUEST);
-	  return;
+	  if (transfer_encoding == TRANSFER_ENCODING_UNKNOWN)
+	    {
+	      log_error (phttp, HTTP_STATUS_NOT_IMPLEMENTED, 0,
+			 "unknown Transfer-Encoding");
+	      http_err_reply (phttp, HTTP_STATUS_NOT_IMPLEMENTED);
+	    }
+	  else if (content_length != NO_CONTENT_LENGTH)
+	    {
+	      log_error (phttp, HTTP_STATUS_BAD_REQUEST, 0,
+			 "both Transfer-Encoding and Content-Length given");
+	      http_err_reply (phttp, HTTP_STATUS_BAD_REQUEST);
+	      return;
+	    }
 	}
 
       /*

tests/Makefile.am

@@ -87,6 +87,7 @@ TESTSUITE_AT = \
  incldir.at\
  inclnest.at\
  inclscope.at\
+ invenc.at\
  list.at\
  logfmt.at\
  loglevcomp.at\

tests/invenc.at

@@ -0,0 +1,57 @@
+# This file is part of pound testsuite. -*- autotest -*-
+# Copyright (C) 2023-2024 Sergey Poznyakoff
+#
+# Pound is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# Pound is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with pound.  If not, see <http://www.gnu.org/licenses/>.
+
+# See https://github.com/graygnuorg/pound/issues/18
+
+AT_SETUP([Invalid Transfer-Encoding headers])
+AT_KEYWORDS([transfer-encoding invenc])
+PT_CHECK(
+[ListenHTTP
+	Service
+		Backend
+			Address
+			Port
+		End
+	End
+End
+],
+[GET /echo/foo
+Transfer-Encoding: surprise
+end
+
+501
+end
+])
+
+PT_CHECK(
+[ListenHTTP
+	Service
+		Backend
+			Address
+			Port
+		End
+	End
+End
+],
+[GET /echo/foo
+Transfer-Encoding: chunked
+Content-Length: 0
+end
+
+400
+end
+])
+AT_CLEANUP

tests/testsuite.at

@@ -61,6 +61,7 @@ m4_include([maxrequest.at])
 m4_include([rewriteloc.at])
 m4_include([nb.at])
 m4_include([chunked.at])
+m4_include([invenc.at])
 
 AT_BANNER([Listener request modification])
 m4_include([lstset.at])