MINOR: http/hardening: add "delete-all-trailer-fields"

Deletes from requests and responses any trailer field, regardless of
its content or syntax. This is done after syntactic checks though. The
vast majority of public facing applications do not use trailers because
they are not reliable (intermediaries are allowed to drop or fold them)
and their presence on public networks is generally associated with
attack attempts. It is generally safe to drop them by default on public
facing listeners, and even on servers meant to deliver public contents,
in order to avoid any information leakage. Note that gRPC services use
them.

diff --git a/doc/configuration.txt b/doc/configuration.txt
index acb31bd6d8cba25a8267eb83db3dba7f21bebce8..73ab52582b6829d8b11f638d4a0666307aacb0e7 100644 (file)
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -34525,6 +34525,17 @@ http-hardening <name> [from <name2>]
         This keyword covers all known keywords together. It is essentially used
         to enable or disable all checks at once.
 
+  - delete-all-trailer-fields (inbound, request and response)
+        Deletes from requests and responses any trailer field, regardless of
+        its content or syntax. This is done after syntactic checks though. The
+        vast majority of public facing applications do not use trailers because
+        they are not reliable (intermediaries are allowed to drop or fold them)
+        and their presence on public networks is generally associated with
+        attack attempts. It is generally safe to drop them by default on public
+        facing listeners, and even on servers meant to deliver public contents,
+        in order to avoid any information leakage. Note that gRPC services use
+        them, in responses only.
+
   - delete-underscore-in-header-name (inbound, request and response)
         Deletes from requests and responses any header field whose name
         contains an underscore character ('_' or \x5C). While this character is

diff --git a/include/haproxy/http-t.h b/include/haproxy/http-t.h
index e5019bb3d3f0f62101deccafcf56576d00f31c71..2637bec248243bfd5befd45d0bb8feef317bb254 100644 (file)
--- a/include/haproxy/http-t.h
+++ b/include/haproxy/http-t.h
@@ -248,6 +248,7 @@ struct http_violation {
 #define HTTP_HRD_DEL_USCORE_TLR_NAM         0x00000020
 #define HTTP_HRD_DEL_UNREG_HDR              0x00000040
 #define HTTP_HRD_DEL_UNREG_TLR              0x00000080
+#define HTTP_HRD_DEL_ALL_TLR                0x00000100
 /* insert new masks above this line */
 #define HTTP_HRD_ALL                        0xFFFFFFFF
 

diff --git a/src/http.c b/src/http.c
index a4df4e177c5532782e34429167122bbbbbcf1611..4055b0528064949250e46c250eefe4a6f4285753 100644 (file)
--- a/src/http.c
+++ b/src/http.c
@@ -1783,6 +1783,7 @@ const struct http_hardening_kw http_hardening_kws[] = {
        { "delete-underscore-in-trailer-name", HTTP_HRD_DEL_USCORE_TLR_NAM, HTTP_DIR_BOTH },
        { "delete-unregistered-header-fields",HTTP_HRD_DEL_UNREG_HDR, HTTP_DIR_BOTH },
        { "delete-unregistered-trailer-fields",HTTP_HRD_DEL_UNREG_TLR, HTTP_DIR_BOTH },
+       { "delete-all-trailer-fields",         HTTP_HRD_DEL_ALL_TLR, HTTP_DIR_BOTH },
        /* insert new hardening options above this line */
        { "all",                            HTTP_HRD_ALL,              HTTP_DIR_BOTH },
        { NULL, 0 }

diff --git a/src/http_htx.c b/src/http_htx.c
index 39f4cb352e46958c80f95a5de75a3bf3c6a93261..99f21157818702951516d69be1ddbe137491a4f1 100644 (file)
--- a/src/http_htx.c
+++ b/src/http_htx.c
@@ -2074,6 +2074,12 @@ enum http_parser_status http_trailers_to_htx(struct http_hdr *list, struct htx *
                        goto fail;
                }
 
+               /* we may have to delete any trailer (we do that after syntax check) */
+               if (unlikely(http_harden(HTTP_HRD_DEL_ALL_TLR))) {
+                       /* skip it, so it won't be added */
+                       continue;
+               }
+
                /* we may have to delete trailers with underscores
                 * in their names. These ones are already marked
                 * as found when not rejected so we can avoid a