mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-21 22:01:31 +02:00
Code Issues Projects Releases Wiki Activity

MINOR: connection: use the srv pointer for the srv conn hash

Browse Source 
The pointer of the target server is used as a first parameter for the
server connection hash calcul. This prevents the hash to be null when no
specific parameters are present, and can serve as a simple defense
against an attacker trying to reuse a non-conform connection.
This commit is contained in:
Amaury Denoyelle 2021-01-22 16:47:46 +01:00
parent 81c6f76d3e
commit 1a58aca84e
3 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/haproxy/connection-t.h
View File

@ -487,6 +487,7 @@ enum conn_hash_params_t {
* connection hash. * connection hash.
*/ */
struct conn_hash_params { struct conn_hash_params {
struct server *srv;
}; };
/* This structure describes a connection with its methods and data. /* This structure describes a connection with its methods and data.

7
src/backend.c
View File

@ -1251,6 +1251,11 @@ int connect_server(struct stream *s)
/* first, set unique connection parameters and then calculate hash */ /* first, set unique connection parameters and then calculate hash */
memset(&hash_params, 0, sizeof(hash_params)); memset(&hash_params, 0, sizeof(hash_params));
srv = objt_server(s->target);
hash_params.srv = srv;
if (srv)
hash = conn_calculate_hash(&hash_params); hash = conn_calculate_hash(&hash_params);
/* This will catch some corner cases such as lying connections resulting from /* This will catch some corner cases such as lying connections resulting from
@ -1258,8 +1263,6 @@ int connect_server(struct stream *s)
*/ */
si_release_endpoint(&s->si[1]); si_release_endpoint(&s->si[1]);
srv = objt_server(s->target);
/* do not reuse if mode is http or if avail list is not allocated */ /* do not reuse if mode is http or if avail list is not allocated */
if ((s->be->mode != PR_MODE_HTTP) || (srv && !srv->available_conns_tree)) if ((s->be->mode != PR_MODE_HTTP) || (srv && !srv->available_conns_tree))
goto skip_reuse; goto skip_reuse;

2
src/connection.c
View File

@ -1421,6 +1421,8 @@ XXH64_hash_t conn_calculate_hash(const struct conn_hash_params *params)
buf = trash.area; buf = trash.area;
conn_hash_update(buf, &idx, &params->srv, sizeof(params->srv), &hash_flags, 0);
hash = conn_hash_digest(buf, idx, hash_flags); hash = conn_hash_digest(buf, idx, hash_flags);
return hash; return hash;
} }