BUG/MINOR: h1: reject CONNECT authorities with an empty host

h1_validate_connect_authority() checks that the authority of a CONNECT
request contains a non-empty port, but it doesn't check the host part. So
"CONNECT :443 HTTP/1.1" was accepted and forwarded with or without a Host
header, and with "Host: :443" the Host header was even normalized to an
empty value. Such a target is invalid (RFC9112#3.2.3 requires a
uri-host). Let's reject it.

This was introduced by commit 3f5fbe940 ("BUG/MEDIUM: h1: Improve authority
validation for CONNCET request") in 2.7. It should be backported as far as
2.8.

diff --git a/reg-tests/http-messaging/h1_connect_no_host_no_body.vtc b/reg-tests/http-messaging/h1_connect_no_host_no_body.vtc
index 677802c5f1462831da52e8082fb9a6d70b1fc8e3..546a0f18f03528f983e7e62e11b3ad388c5d19dd 100644 (file)
--- a/reg-tests/http-messaging/h1_connect_no_host_no_body.vtc
+++ b/reg-tests/http-messaging/h1_connect_no_host_no_body.vtc
@@ -1,7 +1,8 @@
-varnishtest "H1 CONNECT requests without Host header"
+varnishtest "H1 CONNECT requests without Host header or with an empty host"
 
 # A CONNECT request without Host header must get a Host header built from its
-# authority so that host-based rules apply to it.
+# authority so that host-based rules apply to it. An authority with an empty
+# host is rejected.
 
 feature ignore_unknown_macro
 
@@ -37,3 +38,9 @@ client c6 -connect ${h1_fe1_sock} {
        expect resp.status == 200
        expect resp.http.x-host == "www.example.com:8443"
 } -run
+
+client c5 -connect ${h1_fe1_sock} {
+       txreq -req CONNECT -url ":443" -nohost
+       rxresp
+       expect resp.status == 400
+} -run

diff --git a/src/h1.c b/src/h1.c
index 38d0cccbe840fbf7262dd930ceabfa7dda42b772..12c70d0b16316e72ef86db624aa67fa91233edc1 100644 (file)
--- a/src/h1.c
+++ b/src/h1.c
@@ -123,6 +123,8 @@ static int h1_validate_connect_authority(struct ist scheme, struct ist authority
        if (!istlen(uri_port))
                goto invalid_authority;
        uri_host.len -= (istlen(uri_port) + 1);
+       if (!istlen(uri_host))
+               goto invalid_authority;
 
        if (!host_hdr || !isttest(*host_hdr))
                goto end;