mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-05-01 19:20:59 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MAJOR: http-htx: Store new host in a chunk for scheme-based normalization

Browse Source 
During the scheme based normalization, The original authority value is used
to replace every host headers. It is an issue, because when the HTX message
is modified the blocks may be reorganised to find free space. For instance a
defragmentation can be performed. So the address of the authority can
change. To perform such rewrite, the new value must be stored in a temporary
buffer. It is especially important because the start-line is also updated,
so the original authority could be moved, making it invalid.

Because of this bug, it is possible to mix HTX block values. There is no
overflow but the start-line can be crushed with data from the host header
value, making it invalid for the server.

So, to fix the issue, the new host header value is now the one in the trash
chunk used to rewrite the start line. But in that case, the trash chunk must
be allocated to be sure it remains valid when replacing all host headers
values.

This patch must be backported as far as 2.6.
This commit is contained in:
Christopher Faulet 2026-04-24 10:21:45 +02:00
parent 213ee17119
commit 48afa73af8
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/http_htx.c
View File

@ -1864,7 +1864,7 @@ int http_scheme_based_normalize(struct htx *htx)
if (normalize) {
/* reconstruct the uri with removal of the port */
struct buffer *temp = get_trash_chunk();
struct buffer *temp = alloc_trash_chunk();
struct ist meth, vsn;
/* meth */
@ -1879,16 +1879,23 @@ int http_scheme_based_normalize(struct htx *htx)
chunk_memcat(temp, uri.ptr, authority.ptr - uri.ptr);
chunk_istcat(temp, host);
chunk_istcat(temp, path);
uri = ist2(temp->area + meth.len + vsn.len, host.len + path.len + authority.ptr - uri.ptr); /* uri */
/* update host and uri to point on temp chunk*/
host = ist2(temp->area + meth.len + vsn.len + (authority.ptr - uri.ptr), host.len);
uri = ist2(temp->area + meth.len + vsn.len, host.len + path.len + authority.ptr - uri.ptr);
http_replace_stline(htx, meth, uri, vsn);
/* replace every host headers values by the normalized host */
ctx.blk = NULL;
while (http_find_header(htx, ist("host"), &ctx, 0)) {
if (!http_replace_header_value(htx, &ctx, host))
if (!http_replace_header_value(htx, &ctx, host)) {
free_trash_chunk(temp);
goto fail;
}
}
free_trash_chunk(temp);
}
return 0;