Blame SOURCES/tomcat-7.0.76-CVE-2017-5647.patch

828cdb
--- java/org/apache/coyote/AbstractProtocol.java.orig	2017-08-18 09:12:05.149568367 -0400
828cdb
+++ java/org/apache/coyote/AbstractProtocol.java	2017-08-18 09:12:55.998699189 -0400
828cdb
@@ -693,10 +693,10 @@
828cdb
                     release(wrapper, processor, false, true);
828cdb
                 } else if (state == SocketState.SENDFILE) {
828cdb
                     // Sendfile in progress. If it fails, the socket will be
828cdb
-                    // closed. If it works, the socket will be re-added to the
828cdb
-                    // poller
828cdb
-                    connections.remove(socket);
828cdb
-                    release(wrapper, processor, false, false);
828cdb
+                    // closed. If it works, the socket either be added to the
828cdb
+                    // poller (or equivalent) to await more data or processed
828cdb
+                    // if there are any pipe-lined requests remaining.
828cdb
+                    connections.put(socket, processor);
828cdb
                 } else if (state == SocketState.UPGRADED) {
828cdb
                     // Need to keep the connection associated with the processor
828cdb
                     connections.put(socket, processor);
828cdb
--- java/org/apache/coyote/http11/Http11AprProcessor.java.orig	2017-06-08 16:23:31.983000742 -0400
828cdb
+++ java/org/apache/coyote/http11/Http11AprProcessor.java	2017-06-08 16:23:31.999000805 -0400
828cdb
@@ -38,6 +38,7 @@
828cdb
 import org.apache.tomcat.util.net.AbstractEndpoint.Handler.SocketState;
828cdb
 import org.apache.tomcat.util.net.AprEndpoint;
828cdb
 import org.apache.tomcat.util.net.SSLSupport;
828cdb
+import org.apache.tomcat.util.net.SendfileKeepAliveState;
828cdb
 import org.apache.tomcat.util.net.SocketStatus;
828cdb
 import org.apache.tomcat.util.net.SocketWrapper;
828cdb
 
828cdb
@@ -211,7 +212,15 @@
828cdb
         // Do sendfile as needed: add socket to sendfile and end
828cdb
         if (sendfileData != null && !getErrorState().isError()) {
828cdb
             sendfileData.socket = socketWrapper.getSocket().longValue();
828cdb
-            sendfileData.keepAlive = keepAlive;
828cdb
+            if (keepAlive) {
828cdb
+                if (getInputBuffer().available() == 0) {
828cdb
+                    sendfileData.keepAliveState = SendfileKeepAliveState.OPEN;
828cdb
+                } else {
828cdb
+                    sendfileData.keepAliveState = SendfileKeepAliveState.PIPELINED;
828cdb
+                }
828cdb
+            } else {
828cdb
+                sendfileData.keepAliveState = SendfileKeepAliveState.NONE;
828cdb
+            }
828cdb
             switch (((AprEndpoint)endpoint).getSendfile().add(sendfileData)) {
828cdb
             case DONE:
828cdb
                 return false;
828cdb
--- java/org/apache/coyote/http11/Http11NioProcessor.java.orig	2017-06-08 16:23:31.984000746 -0400
828cdb
+++ java/org/apache/coyote/http11/Http11NioProcessor.java	2017-06-08 16:23:32.000000809 -0400
828cdb
@@ -37,6 +37,7 @@
828cdb
 import org.apache.tomcat.util.net.NioEndpoint.KeyAttachment;
828cdb
 import org.apache.tomcat.util.net.SSLSupport;
828cdb
 import org.apache.tomcat.util.net.SecureNioChannel;
828cdb
+import org.apache.tomcat.util.net.SendfileKeepAliveState;
828cdb
 import org.apache.tomcat.util.net.SocketStatus;
828cdb
 import org.apache.tomcat.util.net.SocketWrapper;
828cdb
 
828cdb
@@ -275,7 +276,15 @@
828cdb
         // Do sendfile as needed: add socket to sendfile and end
828cdb
         if (sendfileData != null && !getErrorState().isError()) {
828cdb
             ((KeyAttachment) socketWrapper).setSendfileData(sendfileData);
828cdb
-            sendfileData.keepAlive = keepAlive;
828cdb
+            if (keepAlive) {
828cdb
+                if (getInputBuffer().available() == 0) {
828cdb
+                    sendfileData.keepAliveState = SendfileKeepAliveState.OPEN;
828cdb
+                } else {
828cdb
+                    sendfileData.keepAliveState = SendfileKeepAliveState.PIPELINED;
828cdb
+                }
828cdb
+            } else {
828cdb
+                sendfileData.keepAliveState = SendfileKeepAliveState.NONE;
828cdb
+            }
828cdb
             SelectionKey key = socketWrapper.getSocket().getIOChannel().keyFor(
828cdb
                     socketWrapper.getSocket().getPoller().getSelector());
828cdb
             //do the first write on this thread, might as well
828cdb
--- java/org/apache/tomcat/util/net/AprEndpoint.java.orig	2017-06-08 16:23:31.985000750 -0400
828cdb
+++ java/org/apache/tomcat/util/net/AprEndpoint.java	2017-06-08 16:23:32.001000813 -0400
828cdb
@@ -2106,7 +2106,7 @@
828cdb
         // Position
828cdb
         public long pos;
828cdb
         // KeepAlive flag
828cdb
-        public boolean keepAlive;
828cdb
+        public SendfileKeepAliveState keepAliveState = SendfileKeepAliveState.NONE;
828cdb
     }
828cdb
 
828cdb
 
828cdb
@@ -2349,20 +2349,33 @@
828cdb
                             state.pos = state.pos + nw;
828cdb
                             if (state.pos >= state.end) {
828cdb
                                 remove(state);
828cdb
-                                if (state.keepAlive) {
828cdb
+                                switch (state.keepAliveState) {
828cdb
+                                case NONE: {
828cdb
+                                    // Close the socket since this is
828cdb
+                                    // the end of the not keep-alive request.
828cdb
+                                    closeSocket(state.socket);
828cdb
+                                    break;
828cdb
+                                }
828cdb
+                                case PIPELINED: {
828cdb
+                                    // Destroy file descriptor pool, which should close the file
828cdb
+                                    Pool.destroy(state.fdpool);
828cdb
+                                    Socket.timeoutSet(state.socket, getSoTimeout() * 1000);
828cdb
+                                    // Process the pipelined request data
828cdb
+                                    if (!processSocket(state.socket, SocketStatus.OPEN_READ)) {
828cdb
+                                        closeSocket(state.socket);
828cdb
+                                    }
828cdb
+                                    break;
828cdb
+                                }
828cdb
+                                case OPEN: {
828cdb
                                     // Destroy file descriptor pool, which should close the file
828cdb
                                     Pool.destroy(state.fdpool);
828cdb
-                                    Socket.timeoutSet(state.socket,
828cdb
-                                            getSoTimeout() * 1000);
828cdb
-                                    // If all done put the socket back in the
828cdb
-                                    // poller for processing of further requests
828cdb
-                                    getPoller().add(
828cdb
-                                            state.socket, getKeepAliveTimeout(),
828cdb
+                                    Socket.timeoutSet(state.socket, getSoTimeout() * 1000);
828cdb
+                                    // Put the socket back in the poller for
828cdb
+                                    // processing of further requests
828cdb
+                                    getPoller().add(state.socket, getKeepAliveTimeout(),
828cdb
                                             true, false);
828cdb
-                                } else {
828cdb
-                                    // Close the socket since this is
828cdb
-                                    // the end of not keep-alive request.
828cdb
-                                    closeSocket(state.socket);
828cdb
+                                    break;
828cdb
+                                }
828cdb
                                 }
828cdb
                             }
828cdb
                         }
828cdb
--- java/org/apache/tomcat/util/net/NioEndpoint.java.orig	2017-06-08 16:23:31.987000757 -0400
828cdb
+++ java/org/apache/tomcat/util/net/NioEndpoint.java	2017-06-08 16:23:32.002000817 -0400
828cdb
@@ -1383,16 +1383,30 @@
828cdb
                     // responsible for registering the socket for the
828cdb
                     // appropriate event(s) if sendfile completes.
828cdb
                     if (!calledByProcessor) {
828cdb
-                        if ( sd.keepAlive ) {
828cdb
-                            if (log.isDebugEnabled()) {
828cdb
-                                log.debug("Connection is keep alive, registering back for OP_READ");
828cdb
-                            }
828cdb
-                            reg(sk,attachment,SelectionKey.OP_READ);
828cdb
-                        } else {
828cdb
+                        switch (sd.keepAliveState) {
828cdb
+                        case NONE: {
828cdb
                             if (log.isDebugEnabled()) {
828cdb
                                 log.debug("Send file connection is being closed");
828cdb
                             }
828cdb
                             cancelledKey(sk,SocketStatus.STOP,false);
828cdb
+                            break;
828cdb
+                        }
828cdb
+                        case PIPELINED: {
828cdb
+                            if (log.isDebugEnabled()) {
828cdb
+                                log.debug("Connection is keep alive, processing pipe-lined data");
828cdb
+                            }
828cdb
+                            if (!processSocket(sc, SocketStatus.OPEN_READ, true)) {
828cdb
+                                cancelledKey(sk, SocketStatus.DISCONNECT, false);
828cdb
+                            }
828cdb
+                            break;
828cdb
+                        }
828cdb
+                        case OPEN: {
828cdb
+                            if (log.isDebugEnabled()) {
828cdb
+                                log.debug("Connection is keep alive, registering back for OP_READ");
828cdb
+                            }
828cdb
+                            reg(sk, attachment, SelectionKey.OP_READ);
828cdb
+                            break;
828cdb
+                        }
828cdb
                         }
828cdb
                     }
828cdb
                     return SendfileState.DONE;
828cdb
@@ -1836,6 +1850,6 @@
828cdb
         public volatile long pos;
828cdb
         public volatile long length;
828cdb
         // KeepAlive flag
828cdb
-        public volatile boolean keepAlive;
828cdb
+        public SendfileKeepAliveState keepAliveState = SendfileKeepAliveState.NONE;
828cdb
     }
828cdb
 }
828cdb
--- webapps/docs/changelog.xml.orig	2017-06-08 16:23:31.989000765 -0400
828cdb
+++ webapps/docs/changelog.xml	2017-06-08 16:25:23.618440723 -0400
828cdb
@@ -73,6 +73,13 @@
828cdb
       </fix>
828cdb
     </changelog>
828cdb
   </subsection>
828cdb
+  <subsection name="Coyote">
828cdb
+    <changelog>
828cdb
+      <fix>
828cdb
+        Improve sendfile handling when requests are pipelined. (markt)
828cdb
+      </fix>
828cdb
+    </changelog>
828cdb
+  </subsection>
828cdb
 </section>
828cdb
 <section name="Tomcat 7.0.76 (violetagg)">
828cdb
   <subsection name="Catalina">
828cdb
--- java/org/apache/tomcat/util/net/SendfileKeepAliveState.java.orig	2017-06-08 16:23:31.992000777 -0400
828cdb
+++ java/org/apache/tomcat/util/net/SendfileKeepAliveState.java	2017-06-08 16:23:32.000000809 -0400
828cdb
@@ -0,0 +1,39 @@
828cdb
+/*
828cdb
+ *  Licensed to the Apache Software Foundation (ASF) under one or more
828cdb
+ *  contributor license agreements.  See the NOTICE file distributed with
828cdb
+ *  this work for additional information regarding copyright ownership.
828cdb
+ *  The ASF licenses this file to You under the Apache License, Version 2.0
828cdb
+ *  (the "License"); you may not use this file except in compliance with
828cdb
+ *  the License.  You may obtain a copy of the License at
828cdb
+ *
828cdb
+ *      http://www.apache.org/licenses/LICENSE-2.0
828cdb
+ *
828cdb
+ *  Unless required by applicable law or agreed to in writing, software
828cdb
+ *  distributed under the License is distributed on an "AS IS" BASIS,
828cdb
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
828cdb
+ *  See the License for the specific language governing permissions and
828cdb
+ *  limitations under the License.
828cdb
+ */
828cdb
+package org.apache.tomcat.util.net;
828cdb
+
828cdb
+public enum SendfileKeepAliveState {
828cdb
+
828cdb
+    /**
828cdb
+     * Keep-alive is not in use. The socket can be closed when the response has
828cdb
+     * been written.
828cdb
+     */
828cdb
+    NONE,
828cdb
+
828cdb
+    /**
828cdb
+     * Keep-alive is in use and there is pipelined data in the input buffer to
828cdb
+     * be read as soon as the current response has been written.
828cdb
+     */
828cdb
+    PIPELINED,
828cdb
+
828cdb
+    /**
828cdb
+     * Keep-alive is in use. The socket should be added to the poller (or
828cdb
+     * equivalent) to await more data as soon as the current response has been
828cdb
+     * written.
828cdb
+     */
828cdb
+    OPEN
828cdb
+}