BUG/MEDIUM: http/auth: Sometimes the authentication credentials can be mix between...

The authentication function "get_http_auth()" extract credentials from
the request and keep it this values in shared cache. This function set
a flag in the session indicating that the authentication is already
parsed and the value stored in the cache are avalaible. If this flag is
set the authorization header is not re-parsed and the shared cache is
used.

If two request are simultaneous processsed, the first one check the
credentials. After this, the second request check also it's credentials
and change the data stored in the shared cache. When the first request
re-check credentials (for many reasons), they are changed. The change
can introduce a segfault.

This patch deactivate the cache upon success. When we need
authentication information from one request, they are re-parsed and
re-decoded. However, a failure to retrieve credentials is still
cached to avoid useless lookups.

This fix needs to be backported to 1.4 as well.

diff --git a/src/proto_http.c b/src/proto_http.c
index a5f95e65d6e5af8d9cc2fc7595f0027f1ab6e66f..bd07984d07d39731d62079c109574ed7f665aef4 100644 (file)
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -1287,7 +1287,9 @@ const char *http_parse_reqline(struct http_msg *msg,
  * Returns the data from Authorization header. Function may be called more
  * than once so data is stored in txn->auth_data. When no header is found
  * or auth method is unknown auth_method is set to HTTP_AUTH_WRONG to avoid
- * searching again for something we are unable to find anyway.
+ * searching again for something we are unable to find anyway. However, if
+ * the result if valid, the cache is not reused because we would risk to
+ * have the credentials overwritten by another session in parallel.
  */
 
 char *get_http_auth_buff;
@@ -1309,9 +1311,6 @@ get_http_auth(struct session *s)
        if (txn->auth.method == HTTP_AUTH_WRONG)
                return 0;
 
-       if (txn->auth.method)
-               return 1;
-
        txn->auth.method = HTTP_AUTH_WRONG;
 
        ctx.idx = 0;