[6.0] dcbe8b9eb Mark req doclose when failing to ignore req body
Martin Blix Grydeland
martin at varnish-software.com
Tue Jan 25 11:05:08 UTC 2022
commit dcbe8b9ebf5b352e2534fc5645afa1d9747e9647
Author: Martin Blix Grydeland <martin at varnish-software.com>
Date: Fri Dec 17 22:10:16 2021 +0100
Mark req doclose when failing to ignore req body
Previously we would ignore errors to iterate the request body into
oblivion in VRB_Ignore(), keeping the connection open. This opens an
out-of-sync vulnerability on H/1 connections.
This patch tests the status of the request body in VRB_Ignore(), marking
the request failed and that it should be closed on errors.
diff --git a/bin/varnishd/cache/cache_req_body.c b/bin/varnishd/cache/cache_req_body.c
index 463b75b38..f289db07a 100644
--- a/bin/varnishd/cache/cache_req_body.c
+++ b/bin/varnishd/cache/cache_req_body.c
@@ -254,6 +254,8 @@ VRB_Ignore(struct req *req)
if (req->req_body_status == REQ_BODY_WITH_LEN ||
req->req_body_status == REQ_BODY_WITHOUT_LEN)
(void)VRB_Iterate(req, httpq_req_body_discard, NULL);
+ if (req->req_body_status == REQ_BODY_FAIL)
+ req->doclose = SC_RX_BODY;
return(0);
}
More information about the varnish-commit
mailing list