From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 11 Oct 2019 07:01:44 +0000 (+0200)
Subject: MINOR: h1: Reject requests with different occurrences of the header host
X-Git-Tag: v2.1-dev3~74
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=497ab4f519f429b87cc47c7df7ea8a5ce369d567;p=thirdparty%2Fhaproxy.git

MINOR: h1: Reject requests with different occurrences of the header host

There is no reason for a client to send several headers host. It even may be
considered as a bug. However, it is totally invalid to have different values for
those. So now, in such case, an error is triggered during the request
parsing. In addition, when several headers host are found with the same value,
only the first instance is kept and others are skipped.
---

diff --git a/src/h1.c b/src/h1.c
index 5bd54f6320..7e7eaa064a 100644
--- a/src/h1.c
+++ b/src/h1.c
@@ -282,6 +282,7 @@ int h1_headers_to_hdr_list(char *start, const char *stop,
 	union h1_sl sl;
 	int skip_update;
 	int restarting;
+	int host_idx;
 	struct ist n, v;       /* header name and value during parsing */
 
 	skip = 0; // do it only once to keep track of the leading CRLF.
@@ -290,6 +291,7 @@ int h1_headers_to_hdr_list(char *start, const char *stop,
 	hdr_count = sol = col = eol = sov = 0;
 	sl.st.status = 0;
 	skip_update = restarting = 0;
+	host_idx = -1;
 
 	if (h1m->flags & H1_MF_HDRS_ONLY) {
 		state = H1_MSG_HDR_FIRST;
@@ -831,6 +833,18 @@ int h1_headers_to_hdr_list(char *start, const char *stop,
 						break;
 					}
 				}
+				else if (isteqi(n, ist("host"))) {
+					if (host_idx == -1)
+						host_idx = hdr_count;
+					else {
+						if (!isteqi(v, hdr[host_idx].v)) {
+							state = H1_MSG_HDR_L2_LWS;
+							goto http_msg_invalid;
+						}
+						/* if the same host, skip it */
+						break;
+					}
+				}
 
 				http_set_hdr(&hdr[hdr_count++], n, v);
 			} while (0);