BUG/MAJOR: http-htx: Store new host in a chunk for scheme-based normalization

During the scheme based normalization, The original authority value is used
to replace every host headers. It is an issue, because when the HTX message
is modified the blocks may be reorganised to find free space. For instance a
defragmentation can be performed. So the address of the authority can
change. To perform such rewrite, the new value must be stored in a temporary
buffer. It is especially important because the start-line is also updated,
so the original authority could be moved, making it invalid.

Because of this bug, it is possible to mix HTX block values. There is no
overflow but the start-line can be crushed with data from the host header
value, making it invalid for the server.

So, to fix the issue, the new host header value is now the one in the trash
chunk used to rewrite the start line. But in that case, the trash chunk must
be allocated to be sure it remains valid when replacing all host headers
values.

This patch must be backported as far as 2.6.

diff --git a/src/http_htx.c b/src/http_htx.c
index 71c63e041c04d0d3a40a69da4ce0b40f430a572d..c803563645b3066c87edec227e8d4431dd8efeb5 100644 (file)
--- a/src/http_htx.c
+++ b/src/http_htx.c
@@ -1864,7 +1864,7 @@ int http_scheme_based_normalize(struct htx *htx)
 
        if (normalize) {
                /* reconstruct the uri with removal of the port */
-               struct buffer *temp = get_trash_chunk();
+               struct buffer *temp = alloc_trash_chunk();
                struct ist meth, vsn;
 
                /* meth */
@@ -1879,16 +1879,23 @@ int http_scheme_based_normalize(struct htx *htx)
                chunk_memcat(temp, uri.ptr, authority.ptr - uri.ptr);
                chunk_istcat(temp, host);
                chunk_istcat(temp, path);
-               uri = ist2(temp->area + meth.len + vsn.len, host.len + path.len + authority.ptr - uri.ptr); /* uri */
+
+               /* update host and uri to point on temp chunk*/
+               host = ist2(temp->area + meth.len + vsn.len + (authority.ptr - uri.ptr), host.len);
+               uri  = ist2(temp->area + meth.len + vsn.len, host.len + path.len + authority.ptr - uri.ptr);
+
 
                http_replace_stline(htx, meth, uri, vsn);
 
                /* replace every host headers values by the normalized host */
                ctx.blk = NULL;
                while (http_find_header(htx, ist("host"), &ctx, 0)) {
-                       if (!http_replace_header_value(htx, &ctx, host))
+                       if (!http_replace_header_value(htx, &ctx, host)) {
+                               free_trash_chunk(temp);
                                goto fail;
+                       }
                }
+               free_trash_chunk(temp);
        }
 
        return 0;