Blame SOURCES/CVE-2019-15605-HTTP-request-smuggling.patch

541da7
From b41d69bedcdbb8fe0cd790d0bcccbb457d6170d3 Mon Sep 17 00:00:00 2001
541da7
From: Sergio Correia <scorreia@redhat.com>
541da7
Date: Wed, 26 Feb 2020 17:03:26 -0300
541da7
Subject: [PATCH] CVE-2019-15605 - HTTP request smuggling
541da7
541da7
Upstream: https://github.com/nodejs/http-parser/commit/7d5c99d09f6743b055d53fc3f642746d9801479b
541da7
541da7
Support multi-coding Transfer-Encoding
541da7
541da7
`Transfer-Encoding` header might have multiple codings in it. Even
541da7
though llhttp cares only about `chunked`, it must check that `chunked`
541da7
is the last coding (if present).
541da7
541da7
ABNF from RFC 7230:
541da7
541da7
```
541da7
Transfer-Encoding = *( "," OWS ) transfer-coding *( OWS "," [ OWS
541da7
    transfer-coding ] )
541da7
transfer-coding = "chunked" / "compress" / "deflate" / "gzip" /
541da7
    transfer-extension
541da7
   transfer-extension = token *( OWS ";" OWS transfer-parameter )
541da7
   transfer-parameter = token BWS "=" BWS ( token / quoted-string )
541da7
```
541da7
541da7
However, if `chunked` is not last - llhttp must assume that the encoding
541da7
and size of the body is unknown (according to 3.3.3 of RFC 7230) and
541da7
read the response until EOF. For request - the error must be raised for
541da7
an unknown `Transfer-Encoding`.
541da7
541da7
Furthermore, 3.3.3 of RFC 7230 explicitly states that presence of both
541da7
`Transfer-Encoding` and `Content-Length` indicates the smuggling attack
541da7
and "ought to be handled as an error".
541da7
541da7
For the lenient mode:
541da7
541da7
* Unknown `Transfer-Encoding` in requests is not an error and request
541da7
  body is simply read until EOF (end of connection)
541da7
* Only `Transfer-Encoding: chunked` together with `Content-Length` would
541da7
  result an error (just like before the patch)
541da7
541da7
PR-URL: nodejs-private/http-parser-private#4
541da7
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
541da7
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
541da7
Reviewed-By: James M Snell <jasnell@gmail.com>
541da7
---
541da7
 http_parser.c | 110 ++++++++++++++++++++++++++++++++++++++++++++------
541da7
 http_parser.h |   8 ++--
541da7
 test.c        |  90 +++++++++++++++++++++++++++++++++++++++--
541da7
 3 files changed, 189 insertions(+), 19 deletions(-)
541da7
541da7
diff --git a/http_parser.c b/http_parser.c
541da7
index aef4437..cd120d8 100644
541da7
--- a/http_parser.c
541da7
+++ b/http_parser.c
541da7
@@ -176,6 +176,22 @@ static const char *method_strings[] =
541da7
 #undef XX
541da7
   };
541da7
 
541da7
+/* Added for handling CVE-2019-15605. */
541da7
+static void reset_flags(http_parser* p)
541da7
+{
541da7
+    p->flags = 0;
541da7
+    p->transfer_encoding = 0;
541da7
+}
541da7
+
541da7
+static void set_transfer_encoding(http_parser* p)
541da7
+{
541da7
+    p->transfer_encoding = 1;
541da7
+}
541da7
+
541da7
+static int is_transfer_encoding(const http_parser* p)
541da7
+{
541da7
+    return p->transfer_encoding;
541da7
+}
541da7
 
541da7
 /* Tokens as defined by rfc 2616. Also lowercases them.
541da7
  *        token       = 1*<any CHAR except CTLs or separators>
541da7
@@ -378,6 +394,7 @@ enum header_states
541da7
   , h_upgrade
541da7
 
541da7
   , h_matching_transfer_encoding_chunked
541da7
+
541da7
   , h_matching_connection_token_start
541da7
   , h_matching_connection_keep_alive
541da7
   , h_matching_connection_close
541da7
@@ -388,6 +405,10 @@ enum header_states
541da7
   , h_connection_keep_alive
541da7
   , h_connection_close
541da7
   , h_connection_upgrade
541da7
+
541da7
+  /* CVE-2019-15605 */
541da7
+  , h_matching_transfer_encoding_token_start
541da7
+  , h_matching_transfer_encoding_token
541da7
   };
541da7
 
541da7
 enum http_host_state
541da7
@@ -722,7 +743,7 @@ reexecute:
541da7
       {
541da7
         if (ch == CR || ch == LF)
541da7
           break;
541da7
-        parser->flags = 0;
541da7
+        reset_flags(parser);
541da7
         parser->content_length = ULLONG_MAX;
541da7
 
541da7
         if (ch == 'H') {
541da7
@@ -757,7 +778,7 @@ reexecute:
541da7
 
541da7
       case s_start_res:
541da7
       {
541da7
-        parser->flags = 0;
541da7
+        reset_flags(parser);
541da7
         parser->content_length = ULLONG_MAX;
541da7
 
541da7
         switch (ch) {
541da7
@@ -921,7 +942,7 @@ reexecute:
541da7
       {
541da7
         if (ch == CR || ch == LF)
541da7
           break;
541da7
-        parser->flags = 0;
541da7
+        reset_flags(parser);
541da7
         parser->content_length = ULLONG_MAX;
541da7
 
541da7
         if (UNLIKELY(!IS_ALPHA(ch))) {
541da7
@@ -1313,6 +1334,7 @@ reexecute:
541da7
                 parser->header_state = h_general;
541da7
               } else if (parser->index == sizeof(TRANSFER_ENCODING)-2) {
541da7
                 parser->header_state = h_transfer_encoding;
541da7
+                set_transfer_encoding(parser);
541da7
               }
541da7
               break;
541da7
 
541da7
@@ -1393,10 +1415,14 @@ reexecute:
541da7
             if ('c' == c) {
541da7
               parser->header_state = h_matching_transfer_encoding_chunked;
541da7
             } else {
541da7
-              parser->header_state = h_general;
541da7
+              parser->header_state = h_matching_transfer_encoding_token;
541da7
             }
541da7
             break;
541da7
 
541da7
+          /* Multi-value `Transfer-Encoding` header */
541da7
+          case h_matching_transfer_encoding_token_start:
541da7
+            break;
541da7
+
541da7
           case h_content_length:
541da7
             if (UNLIKELY(!IS_NUM(ch))) {
541da7
               SET_ERRNO(HPE_INVALID_CONTENT_LENGTH);
541da7
@@ -1539,16 +1565,41 @@ reexecute:
541da7
               goto error;
541da7
 
541da7
             /* Transfer-Encoding: chunked */
541da7
+            case h_matching_transfer_encoding_token_start:
541da7
+              /* looking for 'Transfer-Encoding: chunked' */
541da7
+              if ('c' == c) {
541da7
+                h_state = h_matching_transfer_encoding_chunked;
541da7
+              } else if (STRICT_TOKEN(c)) {
541da7
+                /* TODO(indutny): similar code below does this, but why?
541da7
+                 * At the very least it seems to be inconsistent given that
541da7
+                 * h_matching_transfer_encoding_token does not check for
541da7
+                 * `STRICT_TOKEN`
541da7
+                 */
541da7
+                h_state = h_matching_transfer_encoding_token;
541da7
+              } else if (c == ' ' || c == '\t') {
541da7
+                /* Skip lws */
541da7
+              } else {
541da7
+                h_state = h_general;
541da7
+              }
541da7
+              break;
541da7
+
541da7
             case h_matching_transfer_encoding_chunked:
541da7
               parser->index++;
541da7
               if (parser->index > sizeof(CHUNKED)-1
541da7
                   || c != CHUNKED[parser->index]) {
541da7
-                h_state = h_general;
541da7
+                h_state = h_matching_transfer_encoding_token;
541da7
               } else if (parser->index == sizeof(CHUNKED)-2) {
541da7
                 h_state = h_transfer_encoding_chunked;
541da7
               }
541da7
               break;
541da7
 
541da7
+            case h_matching_transfer_encoding_token:
541da7
+              if (ch == ',') {
541da7
+                h_state = h_matching_transfer_encoding_token_start;
541da7
+                parser->index = 0;
541da7
+              }
541da7
+              break;
541da7
+
541da7
             case h_matching_connection_token_start:
541da7
               /* looking for 'Connection: keep-alive' */
541da7
               if (c == 'k') {
541da7
@@ -1607,7 +1658,7 @@ reexecute:
541da7
               break;
541da7
 
541da7
             case h_transfer_encoding_chunked:
541da7
-              if (ch != ' ') h_state = h_general;
541da7
+              if (ch != ' ') h_state = h_matching_transfer_encoding_token;
541da7
               break;
541da7
 
541da7
             case h_connection_keep_alive:
541da7
@@ -1732,12 +1783,17 @@ reexecute:
541da7
           REEXECUTE();
541da7
         }
541da7
 
541da7
-        /* Cannot use chunked encoding and a content-length header together
541da7
-           per the HTTP specification. */
541da7
-        if ((parser->flags & F_CHUNKED) &&
541da7
+        /* Cannot use transfer-encoding and a content-length header together
541da7
+           per the HTTP specification. (RFC 7230 Section 3.3.3) */
541da7
+         if ((is_transfer_encoding(parser)) &&
541da7
             (parser->flags & F_CONTENTLENGTH)) {
541da7
-          SET_ERRNO(HPE_UNEXPECTED_CONTENT_LENGTH);
541da7
-          goto error;
541da7
+          /* Allow it for lenient parsing as long as `Transfer-Encoding` is
541da7
+           * not `chunked`
541da7
+           */
541da7
+          if (!lenient || (parser->flags & F_CHUNKED)) {
541da7
+            SET_ERRNO(HPE_UNEXPECTED_CONTENT_LENGTH);
541da7
+            goto error;
541da7
+          }
541da7
         }
541da7
 
541da7
         UPDATE_STATE(s_headers_done);
541da7
@@ -1811,8 +1867,31 @@ reexecute:
541da7
           UPDATE_STATE(NEW_MESSAGE());
541da7
           CALLBACK_NOTIFY(message_complete);
541da7
         } else if (parser->flags & F_CHUNKED) {
541da7
-          /* chunked encoding - ignore Content-Length header */
541da7
+          /* chunked encoding - ignore Content-Length header,
541da7
+           * prepare for a chunk */
541da7
           UPDATE_STATE(s_chunk_size_start);
541da7
+        } else if (is_transfer_encoding(parser)) {
541da7
+          if (parser->type == HTTP_REQUEST && !lenient) {
541da7
+            /* RFC 7230 3.3.3 */
541da7
+
541da7
+            /* If a Transfer-Encoding header field
541da7
+             * is present in a request and the chunked transfer coding is not
541da7
+             * the final encoding, the message body length cannot be determined
541da7
+             * reliably; the server MUST respond with the 400 (Bad Request)
541da7
+             * status code and then close the connection.
541da7
+             */
541da7
+            SET_ERRNO(HPE_INVALID_TRANSFER_ENCODING);
541da7
+            RETURN(p - data); /* Error */
541da7
+          } else {
541da7
+            /* RFC 7230 3.3.3 */
541da7
+
541da7
+            /* If a Transfer-Encoding header field is present in a response and
541da7
+             * the chunked transfer coding is not the final encoding, the
541da7
+             * message body length is determined by reading the connection until
541da7
+             * it is closed by the server.
541da7
+             */
541da7
+            UPDATE_STATE(s_body_identity_eof);
541da7
+          }
541da7
         } else {
541da7
           if (parser->content_length == 0) {
541da7
             /* Content-Length header given but zero: Content-Length: 0\r\n */
541da7
@@ -2064,6 +2143,12 @@ http_message_needs_eof (const http_parser *parser)
541da7
     return 0;
541da7
   }
541da7
 
541da7
+  /* RFC 7230 3.3.3, see `s_headers_almost_done` */
541da7
+  if ((is_transfer_encoding(parser)) &&
541da7
+      (parser->flags & F_CHUNKED) == 0) {
541da7
+    return 1;
541da7
+  }
541da7
+
541da7
   if ((parser->flags & F_CHUNKED) || parser->content_length != ULLONG_MAX) {
541da7
     return 0;
541da7
   }
541da7
@@ -2107,6 +2192,7 @@ http_parser_init (http_parser *parser, enum http_parser_type t)
541da7
   parser->type = t;
541da7
   parser->state = (t == HTTP_REQUEST ? s_start_req : (t == HTTP_RESPONSE ? s_start_res : s_start_req_or_res));
541da7
   parser->http_errno = HPE_OK;
541da7
+  reset_flags(parser);
541da7
 }
541da7
 
541da7
 void
541da7
diff --git a/http_parser.h b/http_parser.h
541da7
index ea7bafe..a4841be 100644
541da7
--- a/http_parser.h
541da7
+++ b/http_parser.h
541da7
@@ -275,8 +275,9 @@ enum flags
541da7
   XX(INVALID_INTERNAL_STATE, "encountered unexpected internal state")\
541da7
   XX(STRICT, "strict mode assertion failed")                         \
541da7
   XX(PAUSED, "parser is paused")                                     \
541da7
-  XX(UNKNOWN, "an unknown error occurred")
541da7
-
541da7
+  XX(UNKNOWN, "an unknown error occurred") \
541da7
+  XX(INVALID_TRANSFER_ENCODING,                                      \
541da7
+     "request has invalid transfer-encoding")
541da7
 
541da7
 /* Define HPE_* values for each errno value above */
541da7
 #define HTTP_ERRNO_GEN(n, s) HPE_##n,
541da7
@@ -293,7 +294,7 @@ enum http_errno {
541da7
 struct http_parser {
541da7
   /** PRIVATE **/
541da7
   unsigned int type : 2;         /* enum http_parser_type */
541da7
-  unsigned int flags : 8;        /* F_* values from 'flags' enum; semi-public */
541da7
+  unsigned int flags : 8;       /* F_* values from 'flags' enum; semi-public */
541da7
   unsigned int state : 7;        /* enum state from http_parser.c */
541da7
   unsigned int header_state : 7; /* enum header_state from http_parser.c */
541da7
   unsigned int index : 7;        /* index into current matcher */
541da7
@@ -318,6 +319,7 @@ struct http_parser {
541da7
 
541da7
   /** PUBLIC **/
541da7
   void *data; /* A pointer to get hook to the "connection" or "socket" object */
541da7
+  unsigned int transfer_encoding : 8; /* CVE-2019-15605 */
541da7
 };
541da7
 
541da7
 
541da7
diff --git a/test.c b/test.c
541da7
index a1fa0d3..bb83d14 100644
541da7
--- a/test.c
541da7
+++ b/test.c
541da7
@@ -260,7 +260,6 @@ const struct message requests[] =
541da7
   ,.type= HTTP_REQUEST
541da7
   ,.raw= "POST /post_identity_body_world?q=search#hey HTTP/1.1\r\n"
541da7
          "Accept: */*\r\n"
541da7
-         "Transfer-Encoding: identity\r\n"
541da7
          "Content-Length: 5\r\n"
541da7
          "\r\n"
541da7
          "World"
541da7
@@ -273,10 +272,9 @@ const struct message requests[] =
541da7
   ,.fragment= "hey"
541da7
   ,.request_path= "/post_identity_body_world"
541da7
   ,.request_url= "/post_identity_body_world?q=search#hey"
541da7
-  ,.num_headers= 3
541da7
+  ,.num_headers= 2
541da7
   ,.headers=
541da7
     { { "Accept", "*/*" }
541da7
-    , { "Transfer-Encoding", "identity" }
541da7
     , { "Content-Length", "5" }
541da7
     }
541da7
   ,.body= "World"
541da7
@@ -1172,6 +1170,61 @@ const struct message requests[] =
541da7
   ,.body= ""
541da7
   }
541da7
 
541da7
+#define POST_MULTI_TE_LAST_CHUNKED 43
541da7
+, {.name= "post - multi coding transfer-encoding chunked body"
541da7
+  ,.type= HTTP_REQUEST
541da7
+  ,.raw= "POST / HTTP/1.1\r\n"
541da7
+         "Transfer-Encoding: deflate, chunked\r\n"
541da7
+         "\r\n"
541da7
+         "1e\r\nall your base are belong to us\r\n"
541da7
+         "0\r\n"
541da7
+         "\r\n"
541da7
+  ,.should_keep_alive= TRUE
541da7
+  ,.message_complete_on_eof= FALSE
541da7
+  ,.http_major= 1
541da7
+  ,.http_minor= 1
541da7
+  ,.method= HTTP_POST
541da7
+  ,.query_string= ""
541da7
+  ,.fragment= ""
541da7
+  ,.request_path= "/"
541da7
+  ,.request_url= "/"
541da7
+  ,.num_headers= 1
541da7
+  ,.headers=
541da7
+    { { "Transfer-Encoding" , "deflate, chunked" }
541da7
+    }
541da7
+  ,.body= "all your base are belong to us"
541da7
+  ,.num_chunks_complete= 2
541da7
+  ,.chunk_lengths= { 0x1e }
541da7
+  }
541da7
+
541da7
+#define POST_MULTI_LINE_TE_LAST_CHUNKED 43
541da7
+, {.name= "post - multi coding transfer-encoding chunked body"
541da7
+  ,.type= HTTP_REQUEST
541da7
+  ,.raw= "POST / HTTP/1.1\r\n"
541da7
+         "Transfer-Encoding: deflate,\r\n"
541da7
+         " chunked\r\n"
541da7
+         "\r\n"
541da7
+         "1e\r\nall your base are belong to us\r\n"
541da7
+         "0\r\n"
541da7
+         "\r\n"
541da7
+  ,.should_keep_alive= TRUE
541da7
+  ,.message_complete_on_eof= FALSE
541da7
+  ,.http_major= 1
541da7
+  ,.http_minor= 1
541da7
+  ,.method= HTTP_POST
541da7
+  ,.query_string= ""
541da7
+  ,.fragment= ""
541da7
+  ,.request_path= "/"
541da7
+  ,.request_url= "/"
541da7
+  ,.num_headers= 1
541da7
+  ,.headers=
541da7
+    { { "Transfer-Encoding" , "deflate, chunked" }
541da7
+    }
541da7
+  ,.body= "all your base are belong to us"
541da7
+  ,.num_chunks_complete= 2
541da7
+  ,.chunk_lengths= { 0x1e }
541da7
+  }
541da7
+
541da7
 , {.name= NULL } /* sentinel */
541da7
 };
541da7
 
541da7
@@ -1951,6 +2004,29 @@ const struct message responses[] =
541da7
   ,.chunk_lengths= { 2, 2 }
541da7
   }
541da7
 
541da7
+#define HTTP_200_MULTI_TE_NOT_LAST_CHUNKED 28
541da7
+, {.name= "HTTP 200 response with `chunked` being *not last* Transfer-Encoding"
541da7
+  ,.type= HTTP_RESPONSE
541da7
+  ,.raw= "HTTP/1.1 200 OK\r\n"
541da7
+         "Transfer-Encoding: chunked, identity\r\n"
541da7
+         "\r\n"
541da7
+         "2\r\n"
541da7
+         "OK\r\n"
541da7
+         "0\r\n"
541da7
+         "\r\n"
541da7
+  ,.should_keep_alive= FALSE
541da7
+  ,.message_complete_on_eof= TRUE
541da7
+  ,.http_major= 1
541da7
+  ,.http_minor= 1
541da7
+  ,.status_code= 200
541da7
+  ,.response_status= "OK"
541da7
+  ,.num_headers= 1
541da7
+  ,.headers= { { "Transfer-Encoding", "chunked, identity" }
541da7
+             }
541da7
+  ,.body= "2\r\nOK\r\n0\r\n\r\n"
541da7
+  ,.num_chunks_complete= 0
541da7
+  }
541da7
+
541da7
 , {.name= NULL } /* sentinel */
541da7
 };
541da7
 
541da7
@@ -3629,7 +3705,7 @@ test_chunked_content_length_error (int req)
541da7
   parsed = http_parser_execute(&parser, &settings_null, buf, strlen(buf));
541da7
   assert(parsed == strlen(buf));
541da7
 
541da7
-  buf = "Transfer-Encoding: chunked\r\nContent-Length: 1\r\n\r\n";
541da7
+  buf = "Transfer-Encoding: anything\r\nContent-Length: 1\r\n\r\n";
541da7
   size_t buflen = strlen(buf);
541da7
 
541da7
   parsed = http_parser_execute(&parser, &settings_null, buf, buflen);
541da7
@@ -4277,6 +4353,12 @@ main (void)
541da7
               "fooba",
541da7
               HPE_OK);
541da7
 
541da7
+  // Unknown Transfer-Encoding in request
541da7
+  test_simple("GET / HTTP/1.1\r\n"
541da7
+              "Transfer-Encoding: unknown\r\n"
541da7
+              "\r\n",
541da7
+              HPE_INVALID_TRANSFER_ENCODING);
541da7
+
541da7
   static const char *all_methods[] = {
541da7
     "DELETE",
541da7
     "GET",
541da7
-- 
541da7
2.18.2
541da7