httpd-cvs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From traw...@apache.org
Subject svn commit: r193205 - in /httpd/httpd/trunk: CHANGES modules/proxy/mod_proxy_http.c
Date Thu, 23 Jun 2005 19:20:30 GMT
Author: trawick
Date: Thu Jun 23 12:20:29 2005
New Revision: 193205

URL: http://svn.apache.org/viewcvs?rev=193205&view=rev
Log:
proxy HTTP: If a response contains both Transfer-Encoding and a
Content-Length, remove the Content-Length and don't reuse the
connection, stopping some HTTP Request smuggling attacks.

Modified:
    httpd/httpd/trunk/CHANGES
    httpd/httpd/trunk/modules/proxy/mod_proxy_http.c

Modified: httpd/httpd/trunk/CHANGES
URL: http://svn.apache.org/viewcvs/httpd/httpd/trunk/CHANGES?rev=193205&r1=193204&r2=193205&view=diff
==============================================================================
--- httpd/httpd/trunk/CHANGES (original)
+++ httpd/httpd/trunk/CHANGES Thu Jun 23 12:20:29 2005
@@ -1,6 +1,12 @@
 Changes with Apache 2.1.6
   [Remove entries to the current 2.0 section below, when backported]
 
+  *) SECURITY: 
+     proxy HTTP: If a response contains both Transfer-Encoding and a 
+     Content-Length, remove the Content-Length and don't reuse the
+     connection, stopping some HTTP Request smuggling attacks.
+     [Jeff Trawick]
+
   *) mod_cgid: Fix buffer overflow processing ScriptSock directive.
      [Steve Kemp <steve steve.org.uk>]
 

Modified: httpd/httpd/trunk/modules/proxy/mod_proxy_http.c
URL: http://svn.apache.org/viewcvs/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?rev=193205&r1=193204&r2=193205&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/proxy/mod_proxy_http.c (original)
+++ httpd/httpd/trunk/modules/proxy/mod_proxy_http.c Thu Jun 23 12:20:29 2005
@@ -1128,7 +1128,22 @@
                                                        r->headers_out,
                                                        save_table);
                 }
-                
+
+                /* can't have both Content-Length and Transfer-Encoding */
+                if (apr_table_get(r->headers_out, "Transfer-Encoding")
+                    && apr_table_get(r->headers_out, "Content-Length")) {
+                    /* 2616 section 4.4, point 3: "if both Transfer-Encoding
+                     * and Content-Length are received, the latter MUST be
+                     * ignored"; so unset it here to prevent any confusion
+                     * later. */
+                    apr_table_unset(r->headers_out, "Content-Length");
+                    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,
+                                 r->server,
+                                 "proxy: server %s returned Transfer-Encoding and Content-Length",
+                                 backend->hostname);
+                    backend->close += 1;
+                }
+
                 /* strip connection listed hop-by-hop headers from response */
                 backend->close += ap_proxy_liststr(apr_table_get(r->headers_out,
                                                                  "Connection"),



Mime
View raw message