[gentoo-commits] gentoo-x86 commit in www-servers/monkeyd/files: monkeyd-fix-DoS-headers-parser.patch

[Anthony G. Basile (blueness)]

blueness    13/06/05 20:45:45

  Added:                monkeyd-fix-DoS-headers-parser.patch
  Log:
  Fix DoS bug on headers parser, bug #472400, CVE-2013-3843
  
  (Portage version: 2.1.11.62/cvs/Linux x86_64, signed Manifest commit with key 0xF52D4BBA)

Revision  Changes    Path
1.1                  www-servers/monkeyd/files/monkeyd-fix-DoS-headers-parser.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/www-servers/monkeyd/files/monkeyd-fix-DoS-headers-parser.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/www-servers/monkeyd/files/monkeyd-fix-DoS-headers-parser.patch?rev=1.1&content-type=text/plain

Index: monkeyd-fix-DoS-headers-parser.patch
===================================================================
From 95d646e5de252bfaa8b68c39d0f48e5d82965d41 Mon Sep 17 00:00:00 2001
From: Eduardo Silva <edsiper@×××××.com>
Date: Wed, 5 Jun 2013 12:18:39 -0600
Subject: [PATCH] Fix #182: DoS bug on headers parser

This patch fix the root cause for a problem described in Ticket #182,
actually if a header is malformed like a Header Key without a value, the
ToC parser used to continue processing the next header line.

The solution applied is to improve the ToC generator where it adds extra
validations for at least one colon and forcing each header line to contain
a value or empty space, otherwise the server will trigger a Bad Request
response to the client and close the connection.

Signed-off-by: Eduardo Silva <edsiper@×××××.com>
---
 src/mk_method.c  |   11 ++++++++++-
 src/mk_request.c |   36 +++++++++++++++++++++++++++++-------
 2 files changed, 39 insertions(+), 8 deletions(-)

diff --git a/src/mk_method.c b/src/mk_method.c
index 4a0698a..b35e893 100644
--- a/src/mk_method.c
+++ b/src/mk_method.c
@@ -45,16 +45,25 @@
 
 long int mk_method_validate_content_length(const char *body, int body_len)
 {
+    int crlf;
     struct headers_toc toc;
     long int len;
     mk_pointer tmp;
 
+    crlf = mk_string_search(body, MK_CRLF, MK_STR_INSENSITIVE);
+    if (crlf < 0) {
+        return -1;
+    }
+
     /*
      * obs: Table of Content (toc) is created when the full
      * request has arrived, this function cannot be used from
      * mk_http_pending_request().
      */
-    mk_request_header_toc_parse(&toc, body, body_len);
+    if (mk_request_header_toc_parse(&toc, body + crlf + mk_crlf.len,
+                                    body_len - mk_crlf.len - crlf) < 0) {
+        return -1;
+    }
     tmp = mk_request_header_get(&toc,
                                 mk_rh_content_length.data,
                                 mk_rh_content_length.len);
diff --git a/src/mk_request.c b/src/mk_request.c
index 5c1f07e..083aba8 100644
--- a/src/mk_request.c
+++ b/src/mk_request.c
@@ -121,13 +121,32 @@ static void mk_request_free(struct session_request *sr)
 
 int mk_request_header_toc_parse(struct headers_toc *toc, const char *data, int len)
 {
-    int i;
+    int i = 0;
+    int header_len;
+    int colon;
+    char *q;
     char *p = (char *) data;
-    char *l = 0;
+    char *l = p;
 
     toc->length = 0;
+
+    if (*p == '\r') goto out;
     for (i = 0; l < (data + len) && p && i < MK_HEADERS_TOC_LEN; i++) {
-        l = strstr(p, MK_CRLF);
+        if (*p == '\r') goto out;
+
+        colon = -1;
+        for (q = p; *q != '\r'; ++q) {
+            if (*q == ':') {
+                colon = (q - p);
+            }
+        }
+
+        l          = (q);
+        header_len = (l - p) - mk_crlf.len;
+        if ((colon == -1) || (header_len == colon) || (*++q != '\n')) {
+            return -1;
+        }
+
         if (l) {
             toc->rows[i].init = p;
             toc->rows[i].end = l;
@@ -140,6 +159,7 @@ int mk_request_header_toc_parse(struct headers_toc *toc, const char *data, int l
         }
     }
 
+ out:
     return toc->length;
 }
 
@@ -237,13 +257,15 @@ static int mk_request_header_process(struct session_request *sr)
 
     /* Creating Table of Content (index) for HTTP headers */
     sr->headers_len = sr->body.len - (prot_end + mk_crlf.len);
-    mk_request_header_toc_parse(&sr->headers_toc, headers, sr->headers_len);
+    if (mk_request_header_toc_parse(&sr->headers_toc, headers, sr->headers_len) < 0) {
+        MK_TRACE("Invalid headers");
+        return -1;
+    }
 
     /* Host */
     host = mk_request_header_get(&sr->headers_toc,
                                  mk_rh_host.data,
                                  mk_rh_host.len);
-
     if (host.data) {
         if ((pos_sep = mk_string_char_search_r(host.data, ':', host.len)) >= 0) {
             /* TCP port should not be higher than 65535 */
@@ -321,8 +343,8 @@ static int mk_request_header_process(struct session_request *sr)
             sr->keep_alive = MK_TRUE;
             sr->close_now = MK_FALSE;
         }
-        else if(mk_string_search_n(sr->connection.data, "Close",
-                                   MK_STR_INSENSITIVE, sr->connection.len) >= 0) {
+        else if (mk_string_search_n(sr->connection.data, "Close",
+                                    MK_STR_INSENSITIVE, sr->connection.len) >= 0) {
             sr->keep_alive = MK_FALSE;
             sr->close_now = MK_TRUE;
         }
-- 
1.7.4.1