From 287e9da8d25952de75cef6fc49208815e21a9bd2 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Thu, 22 Dec 2022 09:47:01 +0100 Subject: [PATCH] BUG/MEDIUM: mux-h2: Refuse interim responses with end-stream flag set Origin: https://git.haproxy.org/?p=haproxy-2.2.git;a=commit;h=038a7e8aeb1c5b90c18c55d2bcfb3aaa476bce89 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2023-0056 Bug: https://github.com/haproxy/haproxy/issues/1972 As state in RFC9113#8.1, HEADERS frame with the ES flag set that carries an informational status code is malformed. However, there is no test on this condition. On 2.4 and higher, it is hard to predict consequences of this bug because end of the message is only reported with a flag. But on 2.2 and lower, it leads to a crash because there is an unexpected extra EOM block at the end of an interim response. Now, when a ES flag is detected on a HEADERS frame for an interim message, a stream error is sent (RST_STREAM/PROTOCOL_ERROR). This patch should solve the issue #1972. It should be backported as far as 2.0. (cherry picked from commit 827a6299e6995c5c3ba620d8b7cbacdaef67f2c4) Signed-off-by: Willy Tarreau (cherry picked from commit ebfae006c6b5de1d1fe0cdd51847ec1e39d5cf59) Signed-off-by: Christopher Faulet (cherry picked from commit 84f5cba24f59b1c8339bb38323fcb01f434ba8e5) Signed-off-by: Christopher Faulet (cherry picked from commit f5748a98c34bc889cae9386ca4f7073ab3f4c6b1) Signed-off-by: Christopher Faulet (cherry picked from commit 2c681c6f30fb90adab4701e287ff7a7db669b2e7) [cf: ctx adjustment] Signed-off-by: Christopher Faulet Gbp-Pq: Name 0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch --- src/mux_h2.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/mux_h2.c b/src/mux_h2.c index f0efd94..1258891 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -4487,6 +4487,11 @@ next_frame: *flags |= H2_SF_HEADERS_RCVD; if ((h2c->dff & H2_F_HEADERS_END_STREAM)) { + if (msgf & H2_MSGF_RSP_1XX) { + /* RFC9113#8.1 : HEADERS frame with the ES flag set that carries an informational status code is malformed */ + TRACE_STATE("invalid interim response with ES flag!", H2_EV_RX_FRAME|H2_EV_RX_HDR|H2_EV_H2C_ERR|H2_EV_PROTO_ERR, h2c->conn); + goto fail; + } /* Mark the end of message using EOM */ htx->flags |= HTX_FL_EOI; /* no more data are expected. Only EOM remains to add now */ if (!htx_add_endof(htx, HTX_BLK_EOM)) { -- 2.30.2