[7.0] 29b037fc2 Mark req doclose when failing to ignore req body

[Martin Blix Grydeland]

commit 29b037fc2e3a2bd098d41c642c6b6bff80f0dbd2
Author: Martin Blix Grydeland <martin at varnish-software.com>
Date:   Fri Dec 17 22:10:16 2021 +0100

    Mark req doclose when failing to ignore req body
    
    Previously we would ignore errors to iterate the request body into
    oblivion in VRB_Ignore(), keeping the connection open. This opens an
    out-of-sync vulnerability on H/1 connections.
    
    This patch tests the status of the request body in VRB_Ignore(), marking
    the request failed and that it should be closed on errors.

diff --git a/bin/varnishd/cache/cache_req_body.c b/bin/varnishd/cache/cache_req_body.c
index f4eedc1f5..7f0712a14 100644
--- a/bin/varnishd/cache/cache_req_body.c
+++ b/bin/varnishd/cache/cache_req_body.c
@@ -251,6 +251,8 @@ VRB_Ignore(struct req *req)
 	if (req->req_body_status->avail > 0)
 		(void)VRB_Iterate(req->wrk, req->vsl, req,
 		    httpq_req_body_discard, NULL);
+	if (req->req_body_status == BS_ERROR)
+		req->doclose = SC_RX_BODY;
 	return (0);
 }