proxy HTTP - ignore C-L and disable keepalive to origin server

Submitted by: trawick
Reviewed by:  jorton, wrowe

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@219059 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index f205ee1920a83966dc8939bd6efbdf0903634112..3a6b86e54429d232608f164806ad6ff471d6aa76 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,10 @@
 Changes with Apache 2.0.55
 
+  *) proxy HTTP: If a response contains both Transfer-Encoding and a 
+     Content-Length, remove the Content-Length and don't reuse the
+     connection, mitigating some HTTP Response Splitting attacks.
+     [Jeff Trawick]
+
   *) Prevent hangs of child processes when writing to piped loggers at
      the time of graceful restart.  PR 26467.  [Jeff Trawick]
 

diff --git a/STATUS b/STATUS
index 52738632045ee1093dd2f3f3485af9908738523c..c0504f2e8169329dcf26ca6c816bfa8cf79323b4 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -111,10 +111,6 @@ RELEASE SHOWSTOPPERS:
 
     * Various fixes to T-E and C-L processing from trunk
 
-      + proxy HTTP - ignore C-L and disable keepalive to origin server
-          http://people.apache.org/~trawick/20.te-cl.txt
-        +1: trawick, jorton
-
       + core: strip C-L from any request with a T-E header
           http://people.apache.org/~jorton/ap_tevscl.diff
           (CVE CAN-2005-2088)

diff --git a/modules/proxy/proxy_http.c b/modules/proxy/proxy_http.c
index a26e5caca2e0737a889e36921bb6112a0e443099..57e31d99a23e848d98ee696eeeb312173fae46cc 100644 (file)
--- a/modules/proxy/proxy_http.c
+++ b/modules/proxy/proxy_http.c
@@ -1201,8 +1201,24 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
                 return r->status;
 
             } else {
-                /* strip connection listed hop-by-hop headers from response */
                 const char *buf;
+
+                /* can't have both Content-Length and Transfer-Encoding */
+                if (apr_table_get(r->headers_out, "Transfer-Encoding")
+                    && apr_table_get(r->headers_out, "Content-Length")) {
+                    /* 2616 section 4.4, point 3: "if both Transfer-Encoding
+                     * and Content-Length are received, the latter MUST be
+                     * ignored"; so unset it here to prevent any confusion
+                     * later. */
+                    apr_table_unset(r->headers_out, "Content-Length");
+                    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,
+                                 r->server,
+                                 "proxy: server %s returned Transfer-Encoding and Content-Length",
+                                 p_conn->name);
+                    p_conn->close += 1;
+                }
+                
+                /* strip connection listed hop-by-hop headers from response */
                 p_conn->close += ap_proxy_liststr(apr_table_get(r->headers_out,
                                                                 "Connection"),
                                                   "close");