If the backend sends 304 to a non-conditional fetch, we should not assert

but fail the fetch.

Fixes #1672

Based mostly on patch from martin

bin/varnishd/cache/cache_fetch.c

@@ -190,7 +190,8 @@ vbf_stp_mkbereq(const struct worker *wrk, struct busyobj *bo)
 		AN(bo->req);
 		bo->req = NULL;
 		http_CopyHome(bo->bereq0);
-	}
+	} else
+		AZ(bo->ims_oc);
 
 	if (bo->ims_oc != NULL &&
 	    ObjCheckFlag(bo->wrk, bo->ims_oc, OF_IMSCAND)) {
@@ -259,7 +260,7 @@ vbf_stp_retry(struct worker *wrk, struct busyobj *bo)
 static enum fetch_step
 vbf_stp_startfetch(struct worker *wrk, struct busyobj *bo)
 {
-	int i, do_ims;
+	int i, do_ims = 0;
 	double now;
 	char time_str[VTIM_FORMAT_SIZE];
 
@@ -393,22 +394,33 @@ vbf_stp_startfetch(struct worker *wrk, struct busyobj *bo)
 
 	AZ(bo->do_esi);
 
-	if (bo->ims_oc != NULL && http_IsStatus(bo->beresp, 304)) {
-		if (ObjCheckFlag(bo->wrk, bo->ims_oc, OF_CHGGZIP)) {
+	if (http_IsStatus(bo->beresp, 304)) {
+		if (bo->ims_oc != NULL &&
+		    ObjCheckFlag(bo->wrk, bo->ims_oc, OF_IMSCAND)) {
+			if (ObjCheckFlag(bo->wrk, bo->ims_oc, OF_CHGGZIP)) {
+				/*
+				 * If we changed the gzip status of the object
+				 * the stored Content_Encoding controls we
+				 * must weaken any new ETag we get.
+				 */
+				http_Unset(bo->beresp, H_Content_Encoding);
+				RFC2616_Weaken_Etag(bo->beresp);
+			}
+			http_Unset(bo->beresp, H_Content_Length);
+			HTTP_Merge(bo->wrk, bo->ims_oc, bo->beresp);
+			assert(http_IsStatus(bo->beresp, 200));
+			do_ims = 1;
+		} else if (!bo->do_pass) {
 			/*
-			 * If we changed the gzip status of the object
-			 * the stored Content_Encoding controls we
-			 * must weaken any new ETag we get.
+			 * Backend sent unallowed 304
 			 */
-			http_Unset(bo->beresp, H_Content_Encoding);
-			RFC2616_Weaken_Etag(bo->beresp);
+			VSLb(bo->vsl, SLT_Error,
+			    "304 response but not conditional fetch");
+			bo->doclose = SC_RX_BAD;
+			VDI_Finish(bo->wrk, bo);
+			return (F_STP_FAIL);
 		}
-		http_Unset(bo->beresp, H_Content_Length);
-		HTTP_Merge(bo->wrk, bo->ims_oc, bo->beresp);
-		assert(http_IsStatus(bo->beresp, 200));
-		do_ims = 1;
-	} else
-		do_ims = 0;
+	}
 
 	bo->vfc->bo = bo;
 	bo->vfc->oc = bo->fetch_objcore;

include/tbl/sess_close.h

@@ -32,7 +32,7 @@
 SESS_CLOSE(REM_CLOSE,		"Client Closed")
 SESS_CLOSE(REQ_CLOSE,		"Client requested close")
 SESS_CLOSE(REQ_HTTP10,		"Proto < HTTP/1.1")
-SESS_CLOSE(RX_BAD,		"Received bad request")
+SESS_CLOSE(RX_BAD,		"Received bad req/resp")
 SESS_CLOSE(RX_BODY,		"Failure receiving req.body")
 SESS_CLOSE(RX_JUNK,		"Received junk data")
 SESS_CLOSE(RX_OVERFLOW,		"Received buffer overflow")