BUG/MINOR: ssl: reject a \0 byte in ssl_fc_npn

A string sample cannot contain a \0 byte, but ssl_fc_npn returned the
NPN protocol name as sent by the client, which OpenSSL stores without
checking it against the configured list, so a client could put a \0 in
it. Such a value was then matched by "-m str" on its prefix.

Fail the fetch when the name holds a \0 byte. This only applies when
"npn" is set on the bind line.

This must be backported to all stable branches.

diff --git a/src/ssl_sample.c b/src/ssl_sample.c
index 2725b67ebb762969ee39867862663128461f071a..1a6c472e4b1a51623fc6cbd1d24221c0a8707ed0 100644 (file)
--- a/src/ssl_sample.c
+++ b/src/ssl_sample.c
@@ -1917,6 +1917,10 @@ smp_fetch_ssl_fc_npn(const struct arg *args, struct sample *smp, const char *kw,
        if (!smp->data.u.str.area)
                return 0;
 
+       /* a string sample cannot contain a NUL byte */
+       if (memchr(smp->data.u.str.area, 0, len))
+               return 0;
+
        smp->data.u.str.data = len;
        return 1;
 }