RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2024-12-13 23:14:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MEDIUM: http/auth: Sometimes the authentication credentials can be mix between two requests

Browse Source 
The authentication function "get_http_auth()" extract credentials from
the request and keep it this values in shared cache. This function set
a flag in the session indicating that the authentication is already
parsed and the value stored in the cache are avalaible. If this flag is
set the authorization header is not re-parsed and the shared cache is
used.

If two request are simultaneous processsed, the first one check the
credentials. After this, the second request check also it's credentials
and change the data stored in the shared cache. When the first request
re-check credentials (for many reasons), they are changed. The change
can introduce a segfault.

This patch deactivate the cache upon success. When we need
authentication information from one request, they are re-parsed and
re-decoded. However, a failure to retrieve credentials is still
cached to avoid useless lookups.

This fix needs to be backported to 1.4 as well.
This commit is contained in:
Thierry FOURNIER 2014-01-23 12:13:02 +01:00 committed by Willy Tarreau
parent 70dffdaa10
commit 98d9695518
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/proto_http.c
View File

@ -1287,7 +1287,9 @@ const char *http_parse_reqline(struct http_msg *msg,
* Returns the data from Authorization header. Function may be called more
* than once so data is stored in txn->auth_data. When no header is found
* or auth method is unknown auth_method is set to HTTP_AUTH_WRONG to avoid
* searching again for something we are unable to find anyway.
* searching again for something we are unable to find anyway. However, if
* the result if valid, the cache is not reused because we would risk to
* have the credentials overwritten by another session in parallel.
*/
char *get_http_auth_buff;
@ -1309,9 +1311,6 @@ get_http_auth(struct session *s)
if (txn->auth.method == HTTP_AUTH_WRONG)
return 0;
if (txn->auth.method)
return 1;
txn->auth.method = HTTP_AUTH_WRONG;
ctx.idx = 0;