BUG/MAJOR: h3: check body size with content-length on empty FIN

In QUIC, a STREAM frame may be received with no data but with FIN bit
set. This situation is tedious to handle and haproxy parsing code has
changed several times to deal with this situation. Now, H3 and H09
layers parsing code are skipped in favor of the shared function
qcs_http_handle_standalone_fin() used to handle the HTX EOM emission.

However, this shortcut bypasses an important HTTP/3 validation check on
the received body size vs the announced content-length header. Under
some conditions, this could cause a desynchronization with the backend
server which could be exploited for request smuggling.

Fix HTTP/3 parsing code by adding a call to h3_check_body_size() prior
to qcs_http_handle_standalone_fin() if content-length header has been
found. If the body size is incorrect, the stream is immediately resetted
with H3_MESSAGE_ERROR code and the error is forwarded to the stream
layer.

Thanks to Martino Spagnuolo for his detailed report on this issue and
for having contacting us about it via the security mailing list.

This must be backported up to 2.6.

diff --git a/src/h3.c b/src/h3.c
index ef6502d77f090308334faf1794eee60a98dd1fd9..e10dea69cabdc26e961cd17169bc132aac06d306 100644 (file)
--- a/src/h3.c
+++ b/src/h3.c
@@ -1754,6 +1754,14 @@ static ssize_t h3_rcv_buf(struct qcs *qcs, struct buffer *b, int fin)
 
        if (!b_data(b) && fin && quic_stream_is_bidi(qcs->id)) {
                TRACE_PROTO("received FIN without data", H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
+
+               /* FIN received, ensure body length is conform to any content-length header. */
+               if ((h3s->flags & H3_SF_HAVE_CLEN) && h3_check_body_size(qcs, 1)) {
+                       qcc_abort_stream_read(qcs);
+                       qcc_reset_stream(qcs, h3s->err);
+                       goto done;
+               }
+
                if (qcs_http_handle_standalone_fin(qcs)) {
                        TRACE_ERROR("cannot set EOM", H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
                        qcc_set_error(qcs->qcc, H3_ERR_INTERNAL_ERROR, 1);