BUG/MINOR: http-fetch: fix the space check of http_auth_bearer(<hdr>)

When http_auth_bearer() was called with a custom header name, a test was
performed to know if the value contained a space after the scheme, by
comparing the length of the scheme with the length of the header value.

But istsplit() had already advanced <ctx.value> past the scheme and the
space at this point, so the comparison was made with the length of the token
instead:

  - a token of exactly 6 characters, the length of "Bearer", was reported as
    a mismatch, e.g. "Bearer abcdef";

  - a lone "Bearer" without any space was accepted and returned an empty
    token.

Let's compare with the length of the value before it is split. The reg-test
is extended with these two cases.

This should be backported to all supported versions.

diff --git a/reg-tests/sample_fetches/http_auth_bearer.vtc b/reg-tests/sample_fetches/http_auth_bearer.vtc
index 037c8ee5e37c926c7e6e2012e8a43606060564fa..4f76a508f1d29d4ac5d3d50f1f0a85efa2531771 100644 (file)
--- a/reg-tests/sample_fetches/http_auth_bearer.vtc
+++ b/reg-tests/sample_fetches/http_auth_bearer.vtc
@@ -3,8 +3,11 @@ varnishtest "http_auth_bearer() on the authorization header and on a custom one"
 # The fetch returns the token of a "Bearer" authorization, either from the
 # Authorization header or from the header given as argument. For the custom
 # header, the value must be the "Bearer" scheme followed by at least one
-# space and the token. When the custom header is absent, nothing is found,
-# so that the Authorization header is checked by the next rule.
+# space and the token, whatever the token length. In particular a token
+# of 6 characters, as long as the word "Bearer" itself, must be found, and
+# a lone "Bearer" without any token is not a Bearer authorization. When the
+# custom header is absent, nothing is found, so that the Authorization
+# header is checked by the next rule.
 
 feature ignore_unknown_macro
 
@@ -29,6 +32,11 @@ client c1 -connect ${h1_fe_sock} {
     expect resp.status == 200
     expect resp.http.tok == "a"
 
+    txreq -hdr "x-tok: Bearer abcdef"
+    rxresp
+    expect resp.status == 200
+    expect resp.http.tok == "abcdef"
+
     txreq -hdr "x-tok: Bearer abcdefg"
     rxresp
     expect resp.status == 200
@@ -40,7 +48,11 @@ client c1 -connect ${h1_fe_sock} {
     expect resp.status == 200
     expect resp.http.tok == "xyz123"
 
-    # another scheme
+    # no token, or another scheme
+    txreq -hdr "x-tok: Bearer"
+    rxresp
+    expect resp.status == 404
+
     txreq -hdr "x-tok: Basic abcdef"
     rxresp
     expect resp.status == 404

diff --git a/src/http_fetch.c b/src/http_fetch.c
index f944925c949b3b014190506266d16bf4197d153c..c7c967cb3b41d538394641dda66703f990d55661 100644 (file)
--- a/src/http_fetch.c
+++ b/src/http_fetch.c
@@ -1473,10 +1473,11 @@ static int smp_fetch_http_auth_bearer(const struct arg *args, struct sample *smp
 
                ctx.blk = NULL;
                if (http_find_header(htx, hdr_name, &ctx, 0)) {
+                       struct ist value = ctx.value;
                        struct ist type = istsplit(&ctx.value, ' ');
 
                        /* no space was found or the space is the first character or no "Bearer" method */
-                       if (!istlen(type) || istlen(type) == istlen(ctx.value) || !isteqi(type, ist("Bearer")))
+                       if (!istlen(type) || istlen(type) == istlen(value) || !isteqi(type, ist("Bearer")))
                                return 0;
 
                        /* There must be "at least" one space character between