From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 7 Oct 2026 14:04:50 +0000 (+0200)
Subject: BUG/MINOR: h1: reject CONNECT authorities with an empty host
X-Git-Tag: v3.5-dev10~139
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=62bde6048d8fa60d24277659833866ad82f0dace;p=haproxy.git

BUG/MINOR: h1: reject CONNECT authorities with an empty host

h1_validate_connect_authority() checks that the authority of a CONNECT
request contains a non-empty port, but it doesn't check the host part. So
"CONNECT :443 HTTP/1.1" was accepted and forwarded with or without a Host
header, and with "Host: :443" the Host header was even normalized to an
empty value. Such a target is invalid (RFC9112#3.2.3 requires a
uri-host). Let's reject it.

This was introduced by commit 3f5fbe940 ("BUG/MEDIUM: h1: Improve authority
validation for CONNCET request") in 2.7. It should be backported as far as
2.8.
---

diff --git a/reg-tests/http-messaging/h1_connect_no_host_no_body.vtc b/reg-tests/http-messaging/h1_connect_no_host_no_body.vtc
index 677802c5f..546a0f18f 100644
--- a/reg-tests/http-messaging/h1_connect_no_host_no_body.vtc
+++ b/reg-tests/http-messaging/h1_connect_no_host_no_body.vtc
@@ -1,7 +1,8 @@
-varnishtest "H1 CONNECT requests without Host header"
+varnishtest "H1 CONNECT requests without Host header or with an empty host"
 
 # A CONNECT request without Host header must get a Host header built from its
-# authority so that host-based rules apply to it.
+# authority so that host-based rules apply to it. An authority with an empty
+# host is rejected.
 
 feature ignore_unknown_macro
 
@@ -37,3 +38,9 @@ client c6 -connect ${h1_fe1_sock} {
 	expect resp.status == 200
 	expect resp.http.x-host == "www.example.com:8443"
 } -run
+
+client c5 -connect ${h1_fe1_sock} {
+	txreq -req CONNECT -url ":443" -nohost
+	rxresp
+	expect resp.status == 400
+} -run
diff --git a/src/h1.c b/src/h1.c
index 38d0cccbe..12c70d0b1 100644
--- a/src/h1.c
+++ b/src/h1.c
@@ -123,6 +123,8 @@ static int h1_validate_connect_authority(struct ist scheme, struct ist authority
 	if (!istlen(uri_port))
 		goto invalid_authority;
 	uri_host.len -= (istlen(uri_port) + 1);
+	if (!istlen(uri_host))
+		goto invalid_authority;
 
 	if (!host_hdr || !isttest(*host_hdr))
 		goto end;