aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGuillaume Quintard <guillaume.quintard@gmail.com>2022-01-27 11:13:02 +0100
committerGuillaume Quintard <guillaume.quintard@gmail.com>2022-01-30 11:45:02 -0800
commit96db46fae4079ec1e53ad3ee30b610d4894346d0 (patch)
treeba63703a87e9a22abe356b1fef1e64ce479497b9
parent49f8ac67d23bb9450b696dbdb22cd136daf62306 (diff)
main/varnish: mitigate CVE-2022-23959
-rw-r--r--main/varnish/0001-Mark-req-doclose-when-failing-to-ignore-req-body.patch31
-rw-r--r--main/varnish/0002-VRB_Ignore-errors-and-connection-close-test-case.patch75
-rw-r--r--main/varnish/APKBUILD10
3 files changed, 114 insertions, 2 deletions
diff --git a/main/varnish/0001-Mark-req-doclose-when-failing-to-ignore-req-body.patch b/main/varnish/0001-Mark-req-doclose-when-failing-to-ignore-req-body.patch
new file mode 100644
index 00000000000..c8d3fde7f18
--- /dev/null
+++ b/main/varnish/0001-Mark-req-doclose-when-failing-to-ignore-req-body.patch
@@ -0,0 +1,31 @@
+From fceaefd4d59a3b5d5a4903a3f420e35eb430d0d4 Mon Sep 17 00:00:00 2001
+From: Martin Blix Grydeland <martin@varnish-software.com>
+Date: Fri, 17 Dec 2021 22:10:16 +0100
+Subject: [PATCH 1/2] Mark req doclose when failing to ignore req body
+
+Previously we would ignore errors to iterate the request body into
+oblivion in VRB_Ignore(), keeping the connection open. This opens an
+out-of-sync vulnerability on H/1 connections.
+
+This patch tests the status of the request body in VRB_Ignore(), marking
+the request failed and that it should be closed on errors.
+---
+ bin/varnishd/cache/cache_req_body.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/bin/varnishd/cache/cache_req_body.c b/bin/varnishd/cache/cache_req_body.c
+index 6391f928d..5ffd08b77 100644
+--- a/bin/varnishd/cache/cache_req_body.c
++++ b/bin/varnishd/cache/cache_req_body.c
+@@ -254,6 +254,8 @@ VRB_Ignore(struct req *req)
+ if (req->req_body_status->avail > 0)
+ (void)VRB_Iterate(req->wrk, req->vsl, req,
+ httpq_req_body_discard, NULL);
++ if (req->req_body_status == BS_ERROR)
++ req->doclose = SC_RX_BODY;
+ return (0);
+ }
+
+--
+2.35.0
+
diff --git a/main/varnish/0002-VRB_Ignore-errors-and-connection-close-test-case.patch b/main/varnish/0002-VRB_Ignore-errors-and-connection-close-test-case.patch
new file mode 100644
index 00000000000..7343dc0ba4a
--- /dev/null
+++ b/main/varnish/0002-VRB_Ignore-errors-and-connection-close-test-case.patch
@@ -0,0 +1,75 @@
+From 1020be7e886399a4e94407ae0dfbfd1475cc5756 Mon Sep 17 00:00:00 2001
+From: Martin Blix Grydeland <martin@varnish-software.com>
+Date: Fri, 17 Dec 2021 22:10:27 +0100
+Subject: [PATCH 2/2] VRB_Ignore() errors and connection close test case
+
+---
+ bin/varnishtest/tests/f00008.vtc | 56 ++++++++++++++++++++++++++++++++
+ 1 file changed, 56 insertions(+)
+ create mode 100644 bin/varnishtest/tests/f00008.vtc
+
+diff --git a/bin/varnishtest/tests/f00008.vtc b/bin/varnishtest/tests/f00008.vtc
+new file mode 100644
+index 000000000..4d6161a35
+--- /dev/null
++++ b/bin/varnishtest/tests/f00008.vtc
+@@ -0,0 +1,56 @@
++varnishtest "VRB_Ignore and connection close"
++
++server s1 {
++ rxreq
++ txresp -body HIT
++} -start
++
++varnish v1 -arg "-p timeout_idle=1" -vcl+backend {
++ sub vcl_recv {
++ if (req.url == "/synth") {
++ return (synth(200, "SYNTH"));
++ }
++ }
++} -start
++
++# Prime an object
++client c1 {
++ txreq -url /hit
++ rxresp
++ expect resp.status == 200
++ expect resp.body == HIT
++} -run
++
++# Test synth
++client c2 {
++ txreq -req POST -url /synth -hdr "Content-Length: 2"
++ # Send 1 byte
++ send a
++ # Wait timeout_idle
++ delay 1.1
++ # Send 1 byte
++ send b
++ rxresp
++ expect resp.status == 200
++ expect resp.reason == SYNTH
++ expect resp.http.connection == close
++ timeout 0.5
++ expect_close
++} -run
++
++# Test cache hit
++client c3 {
++ txreq -req GET -url /hit -hdr "Content-Length: 2"
++ # Send 1 byte
++ send a
++ # Wait timeout_idle
++ delay 1.1
++ # Send 1 byte
++ send b
++ rxresp
++ expect resp.status == 200
++ expect resp.body == HIT
++ expect resp.http.connection == close
++ timeout 0.5
++ expect_close
++} -run
+--
+2.35.0
+
diff --git a/main/varnish/APKBUILD b/main/varnish/APKBUILD
index 47030bdb329..0aad693f469 100644
--- a/main/varnish/APKBUILD
+++ b/main/varnish/APKBUILD
@@ -4,7 +4,7 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=varnish
pkgver=6.5.2
-pkgrel=0
+pkgrel=1
pkgdesc="High-performance HTTP accelerator"
url="https://www.varnish-cache.org/"
arch="all"
@@ -27,10 +27,14 @@ source="https://varnish-cache.org/_downloads/varnish-$pkgver.tgz
varnishncsa.initd
varnishncsa.confd
varnishd.logrotate
- maxminddb.vcl"
+ maxminddb.vcl
+ 0001-Mark-req-doclose-when-failing-to-ignore-req-body.patch
+ 0002-VRB_Ignore-errors-and-connection-close-test-case.patch"
# secfixes:
+# 6.5.2-r1:
+# - CVE-2022-23959
# 6.5.2-r0:
# - CVE-2021-36740
# 6.2.1-r0:
@@ -109,4 +113,6 @@ e0b7d67bbd710f0a17b77837c581f128e6b746eff2b12e81d03d1ad040037e95bb00fb8007d89bc6
a5426ff66b89d2afb6273f05e4117b3eec5ce0162a624d52c92b418960f72e58bd01224165613221af76ec241bd98e1eb985b2ef7b83a5b615e9ece67234dcc8 varnishncsa.confd
51cc6d46ff7439de93977ab87dfb0af399458c1e446475696f73342ae7a0c1a8ca8fc6e79e593659f1af30716a5f8a1ee5e3b1f5e7b35df40b45d47e7b0f2ffd varnishd.logrotate
69f088819cff6d4441813be284f4117f232d08908515bd15d96bd5bb9d41ba7100657a52fd408d44c396d004366062ae22fbf08e2a983cd8023b554539ccf596 maxminddb.vcl
+62f8c3f86d283b20f25db20504434095392c1aacbf4c91cea0ee9ba3cfd22ad1de928cb56ff4e1a226a5b31cc25466dcae0f28a8ebf575faa8655a9676ea896c 0001-Mark-req-doclose-when-failing-to-ignore-req-body.patch
+010d96023cd03c5350da9d779cbb05f0ce47b36d47869ace01e2c7cd841fffb610f28b39118bf9bc36617f778ab59a5d913b14ae2e71467852f6390021f7a295 0002-VRB_Ignore-errors-and-connection-close-test-case.patch
"