Skip to content

fix(nanopush): panic on GoAwayError code path#248

Merged
jessepeterson merged 1 commit intomicromdm:mainfrom
MagnusHJensen:fix-goaway-panic
Apr 8, 2026
Merged

fix(nanopush): panic on GoAwayError code path#248
jessepeterson merged 1 commit intomicromdm:mainfrom
MagnusHJensen:fix-goaway-panic

Conversation

@MagnusHJensen
Copy link
Copy Markdown
Contributor

This PR fixes a subtle (and most likely never hit) code panic.

The code path in the nanopush provider, used the r.StatusCode, which is not available. I'm not sure if we are okay with the error being built assumes it's an HTTP status code, but we instead pass the GoAway error code.

@MagnusHJensen MagnusHJensen changed the title fix(nanopush): fix panic on GoAwayError fix(nanopush): panic on GoAwayError code path Apr 8, 2026
Copy link
Copy Markdown
Member

@jessepeterson jessepeterson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch. However I think this makes the assumption that r==nil if err!=nil. Seems unlikely to be a relevant response if there's an error, but that's a potential gap we'd be missing. In any case: this seems fine. We can address if we wanted r.StatusCode; or maybe have a fallback.

@jessepeterson jessepeterson merged commit 0f68a3a into micromdm:main Apr 8, 2026
9 checks passed
@MagnusHJensen MagnusHJensen deleted the fix-goaway-panic branch April 8, 2026 23:28
@MagnusHJensen
Copy link
Copy Markdown
Contributor Author

MagnusHJensen commented Apr 8, 2026

Yeah, based on my dive into the code (and slight exploration into the net/http) I had a hard time finding a case where r != nil && err != nil, hence why I opted for this approach instead of just gating the r.StatusCode check

Bahtya pushed a commit to Bahtya/fleet that referenced this pull request Apr 9, 2026
Use int(goAwayErr.ErrCode) instead of r.StatusCode when building the
push.Response on an http2.GoAwayError. When a GOAWAY frame is received,
http.Client.Do returns a nil response, so accessing r.StatusCode would
panic. Using the HTTP/2 error code from the GoAwayError itself is cleaner
and matches the fix merged upstream in micromdm/nanomdm#248.

Also adds TestGoAwayErrorNoPanic — a regression test using a mock Doer
that returns a GoAwayError — to prevent future regressions.

Bahtya
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants