[PATCH] BUG/MAJOR: h3: check body size with content-length on empty FIN

In QUIC, a STREAM frame may be received with no data but with FIN bit
set. This situation is tedious to handle and haproxy parsing code has
changed several times to deal with this situation. Now, H3 and H09
layers parsing code are skipped in favor of the shared function
qcs_http_handle_standalone_fin() used to handle the HTX EOM emission.

However, this shortcut bypasses an important HTTP/3 validation check on
the received body size vs the announced content-length header. Under
some conditions, this could cause a desynchronization with the backend
server which could be exploited for request smuggling.

Fix HTTP/3 parsing code by adding a call to h3_check_body_size() prior
to qcs_http_handle_standalone_fin() if content-length header has been
found. If the body size is incorrect, the stream is immediately resetted
with H3_MESSAGE_ERROR code and the error is forwarded to the stream
layer.

Thanks to Martino Spagnuolo for his detailed report on this issue and
for having contacting us about it via the security mailing list.

This must be backported up to 2.6.

(cherry picked from commit 05a295441c621089ffa4318daf0dbca2dd756a84)
Signed-off-by: Amaury Denoyelle <adenoyelle@haproxy.com>
(cherry picked from commit 18e450ab412fb9397da36f226db8eed31ab590b6)
Signed-off-by: Amaury Denoyelle <adenoyelle@haproxy.com>
(cherry picked from commit 7ab4ae974c434e62896b3c68b7b485b9dceb7a25)
[ad: remove usage of qcs_http_handle_standalone_fin() introduced in 3.2]
Signed-off-by: Amaury Denoyelle <adenoyelle@haproxy.com>
(cherry picked from commit ae54ad97c84cd6173f134c1f052a5375cf704f5c)
Signed-off-by: Amaury Denoyelle <adenoyelle@haproxy.com>
(cherry picked from commit 425b969d6ea4114f4ae260f57802c65ccafc319c)
[ad: adjust context due to non existent qcc_get_stream_rxbuf()]
Signed-off-by: Amaury Denoyelle <adenoyelle@haproxy.com>
(cherry picked from commit ac75e1863c9dc965a9f7f9e87cdf8c22442ed9cd)
[ad: context adjusted]
Signed-off-by: Amaury Denoyelle <adenoyelle@haproxy.com>
Gbp-Pq: Name 0001-BUG-MAJOR-h3-check-body-size-with-content-length-on-.patch

diff --git a/src/h3.c b/src/h3.c
index 0e20f2c780abf293c8c0b85bb9dc636fee5af57e..624c79e170b4ce9e8deb306bd3bb800e57f900f4 100644 (file)
--- a/src/h3.c
+++ b/src/h3.c
@@ -916,6 +916,12 @@ static ssize_t h3_decode_qcs(struct qcs *qcs, struct buffer *b, int fin)
        }
 
        if (!b_data(b) && fin && quic_stream_is_bidi(qcs->id)) {
+               /* FIN received, ensure body length is conform to any content-length header. */
+               if ((h3s->flags & H3_SF_HAVE_CLEN) && h3_check_body_size(qcs, 1)) {
+                       qcc_emit_cc_app(qcs->qcc, h3c->err, 1);
+                       return -1;
+               }
+
                qcs_http_handle_standalone_fin(qcs);
                return 0;
        }