Blame SOURCES/tomcat-7.0.69-CVE-2017-5647.patch

75b9e1
--- java/org/apache/coyote/AbstractProtocol.java.orig	2017-06-09 13:12:52.784841973 -0400
75b9e1
+++ java/org/apache/coyote/AbstractProtocol.java	2017-06-09 13:12:52.801842031 -0400
75b9e1
@@ -681,10 +681,9 @@
75b9e1
                     release(wrapper, processor, false, true);
75b9e1
                 } else if (state == SocketState.SENDFILE) {
75b9e1
                     // Sendfile in progress. If it fails, the socket will be
75b9e1
-                    // closed. If it works, the socket will be re-added to the
75b9e1
-                    // poller
75b9e1
-                    connections.remove(socket);
75b9e1
-                    release(wrapper, processor, false, false);
75b9e1
+                    // closed. If it works, the socket either be added to the
75b9e1
+                    // poller (or equivalent) to await more data or processed
75b9e1
+                    // if there are any pipe-lined requests remaining.
75b9e1
                 } else if (state == SocketState.UPGRADED) {
75b9e1
                     // Need to keep the connection associated with the processor
75b9e1
                     connections.put(socket, processor);
75b9e1
--- java/org/apache/coyote/http11/Http11AprProcessor.java.orig	2017-06-09 13:12:52.786841980 -0400
75b9e1
+++ java/org/apache/coyote/http11/Http11AprProcessor.java	2017-06-09 13:14:40.975211883 -0400
75b9e1
@@ -38,6 +38,7 @@
75b9e1
 import org.apache.tomcat.util.net.AbstractEndpoint.Handler.SocketState;
75b9e1
 import org.apache.tomcat.util.net.AprEndpoint;
75b9e1
 import org.apache.tomcat.util.net.SSLSupport;
75b9e1
+import org.apache.tomcat.util.net.SendfileKeepAliveState;
75b9e1
 import org.apache.tomcat.util.net.SocketStatus;
75b9e1
 import org.apache.tomcat.util.net.SocketWrapper;
75b9e1
 
75b9e1
@@ -211,7 +212,15 @@
75b9e1
         // Do sendfile as needed: add socket to sendfile and end
75b9e1
         if (sendfileData != null && !getErrorState().isError()) {
75b9e1
             sendfileData.socket = socketWrapper.getSocket().longValue();
75b9e1
-            sendfileData.keepAlive = keepAlive;
75b9e1
+            if (keepAlive) {
75b9e1
+                if (getInputBuffer().available() == 0) {
75b9e1
+                    sendfileData.keepAliveState = SendfileKeepAliveState.OPEN;
75b9e1
+                } else {
75b9e1
+                    sendfileData.keepAliveState = SendfileKeepAliveState.PIPELINED;
75b9e1
+                }
75b9e1
+            } else {
75b9e1
+                sendfileData.keepAliveState = SendfileKeepAliveState.NONE;
75b9e1
+            }
75b9e1
             if (!((AprEndpoint)endpoint).getSendfile().add(sendfileData)) {
75b9e1
                 // Didn't send all of the data to sendfile.
75b9e1
                 if (sendfileData.socket == 0) {
75b9e1
--- java/org/apache/coyote/http11/Http11NioProcessor.java.orig	2017-06-09 13:12:52.787841983 -0400
75b9e1
+++ java/org/apache/coyote/http11/Http11NioProcessor.java	2017-06-09 13:12:52.800842027 -0400
75b9e1
@@ -37,6 +37,7 @@
75b9e1
 import org.apache.tomcat.util.net.NioEndpoint.KeyAttachment;
75b9e1
 import org.apache.tomcat.util.net.SSLSupport;
75b9e1
 import org.apache.tomcat.util.net.SecureNioChannel;
75b9e1
+import org.apache.tomcat.util.net.SendfileKeepAliveState;
75b9e1
 import org.apache.tomcat.util.net.SocketStatus;
75b9e1
 import org.apache.tomcat.util.net.SocketWrapper;
75b9e1
 
75b9e1
@@ -275,7 +276,15 @@
75b9e1
         // Do sendfile as needed: add socket to sendfile and end
75b9e1
         if (sendfileData != null && !getErrorState().isError()) {
75b9e1
             ((KeyAttachment) socketWrapper).setSendfileData(sendfileData);
75b9e1
-            sendfileData.keepAlive = keepAlive;
75b9e1
+            if (keepAlive) {
75b9e1
+                if (getInputBuffer().available() == 0) {
75b9e1
+                    sendfileData.keepAliveState = SendfileKeepAliveState.OPEN;
75b9e1
+                } else {
75b9e1
+                    sendfileData.keepAliveState = SendfileKeepAliveState.PIPELINED;
75b9e1
+                }
75b9e1
+            } else {
75b9e1
+                sendfileData.keepAliveState = SendfileKeepAliveState.NONE;
75b9e1
+            }
75b9e1
             SelectionKey key = socketWrapper.getSocket().getIOChannel().keyFor(
75b9e1
                     socketWrapper.getSocket().getPoller().getSelector());
75b9e1
             //do the first write on this thread, might as well
75b9e1
--- java/org/apache/tomcat/util/net/AprEndpoint.java.orig	2017-06-09 13:12:52.788841986 -0400
75b9e1
+++ java/org/apache/tomcat/util/net/AprEndpoint.java	2017-06-09 13:12:52.801842031 -0400
75b9e1
@@ -2087,7 +2087,7 @@
75b9e1
         // Position
75b9e1
         public long pos;
75b9e1
         // KeepAlive flag
75b9e1
-        public boolean keepAlive;
75b9e1
+        public SendfileKeepAliveState keepAliveState = SendfileKeepAliveState.NONE;
75b9e1
     }
75b9e1
 
75b9e1
 
75b9e1
@@ -2330,20 +2330,33 @@
75b9e1
                             state.pos = state.pos + nw;
75b9e1
                             if (state.pos >= state.end) {
75b9e1
                                 remove(state);
75b9e1
-                                if (state.keepAlive) {
75b9e1
+                                switch (state.keepAliveState) {
75b9e1
+                                case NONE: {
75b9e1
+                                    // Close the socket since this is
75b9e1
+                                    // the end of the not keep-alive request.
75b9e1
+                                    closeSocket(state.socket);
75b9e1
+                                    break;
75b9e1
+                                }
75b9e1
+                                case PIPELINED: {
75b9e1
+                                    // Destroy file descriptor pool, which should close the file
75b9e1
+                                    Pool.destroy(state.fdpool);
75b9e1
+                                    Socket.timeoutSet(state.socket, getSoTimeout() * 1000);
75b9e1
+                                    // Process the pipelined request data
75b9e1
+                                    if (!processSocket(state.socket, SocketStatus.OPEN_READ)) {
75b9e1
+                                        closeSocket(state.socket);
75b9e1
+                                    }
75b9e1
+                                    break;
75b9e1
+                                }
75b9e1
+                                case OPEN: {
75b9e1
                                     // Destroy file descriptor pool, which should close the file
75b9e1
                                     Pool.destroy(state.fdpool);
75b9e1
-                                    Socket.timeoutSet(state.socket,
75b9e1
-                                            getSoTimeout() * 1000);
75b9e1
-                                    // If all done put the socket back in the
75b9e1
-                                    // poller for processing of further requests
75b9e1
-                                    getPoller().add(
75b9e1
-                                            state.socket, getKeepAliveTimeout(),
75b9e1
+                                    Socket.timeoutSet(state.socket, getSoTimeout() * 1000);
75b9e1
+                                    // Put the socket back in the poller for
75b9e1
+                                    // processing of further requests
75b9e1
+                                    getPoller().add(state.socket, getKeepAliveTimeout(),
75b9e1
                                             true, false);
75b9e1
-                                } else {
75b9e1
-                                    // Close the socket since this is
75b9e1
-                                    // the end of not keep-alive request.
75b9e1
-                                    closeSocket(state.socket);
75b9e1
+                                    break;
75b9e1
+                                }
75b9e1
                                 }
75b9e1
                             }
75b9e1
                         }
75b9e1
--- java/org/apache/tomcat/util/net/NioEndpoint.java.orig	2017-06-09 13:12:52.790841993 -0400
75b9e1
+++ java/org/apache/tomcat/util/net/NioEndpoint.java	2017-06-09 13:16:26.637573150 -0400
75b9e1
@@ -1380,17 +1380,32 @@
75b9e1
                     // responsible for registering the socket for the
75b9e1
                     // appropriate event(s) if sendfile completes.
75b9e1
                     if (!calledByProcessor) {
75b9e1
-                        if ( sd.keepAlive ) {
75b9e1
+                        switch (sd.keepAliveState) {
75b9e1
+                        case NONE: {
75b9e1
                                 if (log.isDebugEnabled()) {
75b9e1
-                                    log.debug("Connection is keep alive, registering back for OP_READ");
75b9e1
-                                }
75b9e1
-                                reg(sk,attachment,SelectionKey.OP_READ);
75b9e1
-                        } else {
75b9e1
-                            if (log.isDebugEnabled()) {
75b9e1
                                 log.debug("Send file connection is being closed");
75b9e1
                             }
75b9e1
                             cancelledKey(sk,SocketStatus.STOP,false);
75b9e1
+                            break;
75b9e1
+                        }
75b9e1
+                        case PIPELINED: {
75b9e1
+                            if (log.isDebugEnabled()) {
75b9e1
+                                log.debug("Connection is keep alive, processing pipe-lined data");
75b9e1
+                            }
75b9e1
+                            if (!processSocket(sc, SocketStatus.OPEN_READ, true)) {
75b9e1
+                                cancelledKey(sk, SocketStatus.DISCONNECT, false);
75b9e1
+                            }
75b9e1
+                            break;
75b9e1
+                        }
75b9e1
+                        case OPEN: {
75b9e1
+                            if (log.isDebugEnabled()) {
75b9e1
+                                log.debug("Connection is keep alive, registering back for OP_READ");
75b9e1
+                            }
75b9e1
+                            reg(sk, attachment, SelectionKey.OP_READ);
75b9e1
+                            break;
75b9e1
+                        }
75b9e1
                         }
75b9e1
+
75b9e1
                     }
75b9e1
                     return SendfileState.DONE;
75b9e1
                 } else {
75b9e1
@@ -1833,6 +1848,6 @@
75b9e1
         public volatile long pos;
75b9e1
         public volatile long length;
75b9e1
         // KeepAlive flag
75b9e1
-        public volatile boolean keepAlive;
75b9e1
+        public SendfileKeepAliveState keepAliveState = SendfileKeepAliveState.NONE;
75b9e1
     }
75b9e1
 }
75b9e1
--- webapps/docs/changelog.xml.orig	2017-06-09 13:12:52.791841997 -0400
75b9e1
+++ webapps/docs/changelog.xml	2017-06-09 13:14:11.593111423 -0400
75b9e1
@@ -58,7 +58,7 @@
75b9e1
   issues do not "pop up" wrt. others).
75b9e1
 -->
75b9e1
 <section name="Tomcat 7.0.69-12 (csutherl)">
75b9e1
-  <subsection name="Coyote">
75b9e1
+  <subsection name="Catalina">
75b9e1
     <changelog>
75b9e1
       <fix>
75b9e1
         Ensure request and response facades are used when firing application
75b9e1
@@ -66,6 +66,13 @@
75b9e1
       </fix>
75b9e1
     </changelog>
75b9e1
   </subsection>
75b9e1
+  <subsection name="Coyote">
75b9e1
+    <changelog>
75b9e1
+      <fix>
75b9e1
+        Improve sendfile handling when requests are pipelined. (markt)
75b9e1
+      </fix>
75b9e1
+    </changelog>
75b9e1
+  </subsection>
75b9e1
 </section>
75b9e1
 <section name="Tomcat 7.0.69-11 (csutherl)">
75b9e1
   <subsection name="Coyote">
75b9e1
--- java/org/apache/tomcat/util/net/SendfileKeepAliveState.java.orig	2017-06-09 13:12:52.793842003 -0400
75b9e1
+++ java/org/apache/tomcat/util/net/SendfileKeepAliveState.java	2017-06-09 13:12:52.800842027 -0400
75b9e1
@@ -0,0 +1,39 @@
75b9e1
+/*
75b9e1
+ *  Licensed to the Apache Software Foundation (ASF) under one or more
75b9e1
+ *  contributor license agreements.  See the NOTICE file distributed with
75b9e1
+ *  this work for additional information regarding copyright ownership.
75b9e1
+ *  The ASF licenses this file to You under the Apache License, Version 2.0
75b9e1
+ *  (the "License"); you may not use this file except in compliance with
75b9e1
+ *  the License.  You may obtain a copy of the License at
75b9e1
+ *
75b9e1
+ *      http://www.apache.org/licenses/LICENSE-2.0
75b9e1
+ *
75b9e1
+ *  Unless required by applicable law or agreed to in writing, software
75b9e1
+ *  distributed under the License is distributed on an "AS IS" BASIS,
75b9e1
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
75b9e1
+ *  See the License for the specific language governing permissions and
75b9e1
+ *  limitations under the License.
75b9e1
+ */
75b9e1
+package org.apache.tomcat.util.net;
75b9e1
+
75b9e1
+public enum SendfileKeepAliveState {
75b9e1
+
75b9e1
+    /**
75b9e1
+     * Keep-alive is not in use. The socket can be closed when the response has
75b9e1
+     * been written.
75b9e1
+     */
75b9e1
+    NONE,
75b9e1
+
75b9e1
+    /**
75b9e1
+     * Keep-alive is in use and there is pipelined data in the input buffer to
75b9e1
+     * be read as soon as the current response has been written.
75b9e1
+     */
75b9e1
+    PIPELINED,
75b9e1
+
75b9e1
+    /**
75b9e1
+     * Keep-alive is in use. The socket should be added to the poller (or
75b9e1
+     * equivalent) to await more data as soon as the current response has been
75b9e1
+     * written.
75b9e1
+     */
75b9e1
+    OPEN
75b9e1
+}