1
0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2024-12-19 10:14:41 +00:00
haproxy/reg-tests/connection
Tim Duesterhus 488ee7fb6e BUG/MAJOR: proxy_protocol: Properly validate TLV lengths
This patch fixes PROXYv2 parsing when the payload of the TCP connection is
fused with the PROXYv2 header within a single recv() call.

Previously HAProxy ignored the PROXYv2 header length when attempting to
parse the TLV, possibly interpreting the first byte of the payload as a
TLV type.

This patch adds proper validation. It ensures that:

1. TLV parsing stops when the end of the PROXYv2 header is reached.
2. TLV lengths cannot exceed the PROXYv2 header length.
3. The PROXYv2 header ends together with the last TLV, not allowing for
   "stray bytes" to be ignored.

A reg-test was added to ensure proper behavior.

This patch tries to find the sweat spot between a small and easily
backportable one, and a cleaner one that's more easily adaptable to
older versions, hence why it merges the "if" and "while" blocks which
causes a reindent of the whole block. It should be used as-is for
versions 1.9 to 2.1, the block about PP2_TYPE_AUTHORITY should be
dropped for 2.0 and the block about CRC32C should be dropped for 1.8.

This bug was introduced when TLV parsing was added. This happened in commit
b3e54fe387. This commit was first released
with HAProxy 1.6-dev1.

A similar issue was fixed in commit 7209c204bd.

This patch must be backported to HAProxy 1.6+.
2020-03-06 11:11:22 +01:00
..
common.pem
dispatch.vtc REGTEST: rename the reg test files. 2019-04-23 15:37:03 +02:00
proxy_protocol_random_fail.vtc REGTESTS: Adapt proxy_protocol_random_fail.vtc to match normalized URI too 2019-10-14 22:28:50 +02:00
proxy_protocol_tlv_validation.vtc BUG/MAJOR: proxy_protocol: Properly validate TLV lengths 2020-03-06 11:11:22 +01:00