[master] 6c0a38b66 fix bereq rollback with retry

[Nils Goroll]

commit 6c0a38b6622a76b0b7e91859f0696831c2fee805
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Mon Jun 15 20:13:56 2020 +0200

    fix bereq rollback with retry
    
    When retrying after a rollback, we might have unread bytes of the
    backend response body. As we need to finalize the director for rollback,
    all we can do in this case is to close the connection.
    
    Spotted by reza, who also provided the test case, thank you.
    
    Closes #3353

diff --git a/bin/varnishd/cache/cache_fetch.c b/bin/varnishd/cache/cache_fetch.c
index 277a52e4d..c143565f3 100644
--- a/bin/varnishd/cache/cache_fetch.c
+++ b/bin/varnishd/cache/cache_fetch.c
@@ -106,6 +106,11 @@ void Bereq_Rollback(struct busyobj *bo)
 {
 	CHECK_OBJ_NOTNULL(bo, BUSYOBJ_MAGIC);
 
+	if (bo->htc != NULL &&
+	    bo->htc->body_status != BS_NONE &&
+	    bo->htc->body_status != BS_TAKEN)
+		bo->htc->doclose = SC_RESP_CLOSE;
+
 	vbf_cleanup(bo);
 	VCL_TaskLeave(bo->privs);
 	VCL_TaskEnter(bo->privs);
diff --git a/bin/varnishtest/tests/r03353.vtc b/bin/varnishtest/tests/r03353.vtc
new file mode 100644
index 000000000..d5ab5f1a4
--- /dev/null
+++ b/bin/varnishtest/tests/r03353.vtc
@@ -0,0 +1,33 @@
+varnishtest "Test rollback and retry"
+
+server s1 {
+	rxreq
+	txresp -nolen -hdr "Content-Length: 3"
+	expect_close
+	accept
+
+	rxreq
+	txresp -body xxx
+} -start
+
+varnish v1 -vcl+backend {
+	import std;
+
+	sub vcl_backend_response {
+		if (bereq.retries == 0) {
+			std.rollback(bereq);
+		}
+	}
+
+	sub vcl_backend_error {
+		if (bereq.retries == 0) {
+			return (retry);
+		}
+	}
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 200
+} -run