Your message dated Mon, 22 Apr 2013 21:00:07 +0000
with message-id <[email protected]>
and subject line Bug#669148: fixed in squid3 3.3.3-1
has caused the Debian Bug report #669148,
regarding rejects benign variants of double CR ("\r\r\n") request
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
669148: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=669148
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: squid3
Version: 3.1.6-1.2+squeeze2
Severity: normal
Tags: patch
Squid rejects benign requests containing double CR of the form "\r\r\n".
I found that this breaks Squid when operating as a proxy for SONY CE
devices. According to Alex Rousskov, this also breaks "a large variety
of client software" [1]. He further explains [2] that not all requests
of the form "\r\r\n" pose a security threat:
The check was most likely introduced as a short-term defense
against "HTTP request smuggling" attacks identified in an
influential 2004 paper. The paper documented certain
vulnerabilities related to requests with "double CR" sequences, and
Squid was quickly hacked to prohibit such requests as
malformed. However, a more careful reading of the paper indicates
that only LF CR CR LF (a.k.a. "CR header") sequences were
identified as dangerous (note the leading LF). The quick fix was
too aggressive and blocked _all_ requests with CR CR LF sequences,
including benign requests.
Alex provided a patch to address this (I've verified that his patch
solves the problem in my environment).
[1] http://www.squid-cache.org/mail-archive/squid-dev/201007/0252.html
[2]
http://www.squid-cache.org/mail-archive/squid-dev/201007/att-0252/allow-benign-CRs-t3.patch
-- System Information:
Debian Release: 6.0.4
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: kfreebsd-amd64 (x86_64)
Kernel: kFreeBSD 8.1-1-amd64
Locale: LANG=ca_AD.UTF-8, LC_CTYPE=ca_AD.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Improve request smuggling attack detection. Tolerate valid benign HTTP
headers.
Removed "double CR" check from parseHttpRequest() for several reasons:
1) The check was most likely introduced as a short-term defense
against "HTTP request smuggling" attacks identified in an
influential 2004 paper. The paper documented certain
vulnerabilities related to requests with "double CR" sequences, and
Squid was quickly hacked to prohibit such requests as
malformed. However, a more careful reading of the paper indicates
that only LF CR CR LF (a.k.a. "CR header") sequences were
identified as dangerous (note the leading LF). The quick fix was
too aggressive and blocked _all_ requests with CR CR LF sequences,
including benign requests.
2) The check duplicated a HttpHeader::parse() check.
3) The check was slower than the code it duplicated.
Improved "double CR" handling in HttpHeader::parse() to detect
potentially dangerous "empty headers", that is header fields that
contain nothing but CR character(s). Requests with such headers are
rejected as malformed. We used to reject similar requests (and more)
in parseHttpRequest() as described above.
After the change, potentially malicious requests with CR+ headers are
still denied. Other, benign headers ending with CRs are now allowed.
If the HTTP header parser is not "relaxed", benign and valid requests
with extra CR characters are blocked as before.
=== modified file 'src/HttpHeader.cc'
--- src/HttpHeader.cc 2010-05-31 19:51:06 +0000
+++ src/HttpHeader.cc 2010-07-29 18:46:54 +0000
@@ -525,46 +525,53 @@ HttpHeader::parse(const char *header_sta
/* common format headers are "<name>:[ws]<value>" lines delimited by
<CRLF>.
* continuation lines start with a (single) space or tab */
while (field_ptr < header_end) {
const char *field_start = field_ptr;
const char *field_end;
do {
const char *this_line = field_ptr;
field_ptr = (const char *)memchr(field_ptr, '\n', header_end -
field_ptr);
if (!field_ptr)
goto reset; /* missing <LF> */
field_end = field_ptr;
field_ptr++; /* Move to next line */
if (field_end > this_line && field_end[-1] == '\r') {
field_end--; /* Ignore CR LF */
- /* Ignore CR CR LF in relaxed mode */
- if (Config.onoff.relaxed_header_parser && field_end >
this_line + 1 && field_end[-1] == '\r') {
- debugs(55, Config.onoff.relaxed_header_parser <= 0 ? 1 : 2,
- "WARNING: Double CR characters in HTTP header {" <<
getStringPrefix(field_start, field_end) << "}");
- field_end--;
+ if (owner == hoRequest && field_end > this_line) {
+ bool cr_only = true;
+ for (const char *p = this_line; p < field_end && cr_only;
++p) {
+ if (*p != '\r')
+ cr_only = false;
+ }
+ if (cr_only) {
+ debugs(55, 1, "WARNING: Rejecting HTTP request with a
CR+ "
+ "header field to prevent request smuggling
attacks: {" <<
+ getStringPrefix(header_start, header_end) <<
"}");
+ goto reset;
+ }
}
}
/* Barf on stray CR characters */
if (memchr(this_line, '\r', field_end - this_line)) {
debugs(55, 1, "WARNING: suspicious CR characters in HTTP
header {" <<
getStringPrefix(field_start, field_end) << "}");
if (Config.onoff.relaxed_header_parser) {
char *p = (char *) this_line; /* XXX Warning! This
destroys original header content and violates specifications somewhat */
while ((p = (char *)memchr(p, '\r', field_end - p)) !=
NULL)
*p++ = ' ';
} else
goto reset;
}
if (this_line + 1 == field_end && this_line > field_start) {
debugs(55, 1, "WARNING: Blank continuation line in HTTP header
{" <<
getStringPrefix(header_start, header_end) << "}");
=== modified file 'src/client_side.cc'
--- src/client_side.cc 2010-07-25 08:10:12 +0000
+++ src/client_side.cc 2010-07-28 10:12:16 +0000
@@ -2066,50 +2066,40 @@ parseHttpRequest(ConnStateData *conn, Ht
if (*method_p == METHOD_NONE) {
/* XXX need a way to say "this many character length string" */
debugs(33, 1, "clientParseRequestMethod: Unsupported method in request
'" << hp->buf << "'");
hp->request_parse_status = HTTP_METHOD_NOT_ALLOWED;
return parseHttpRequestAbort(conn, "error:unsupported-request-method");
}
/*
* Process headers after request line
* TODO: Use httpRequestParse here.
*/
/* XXX this code should be modified to take a const char * later! */
req_hdr = (char *) hp->buf + hp->req_end + 1;
debugs(33, 3, "parseHttpRequest: req_hdr = {" << req_hdr << "}");
end = (char *) hp->buf + hp->hdr_end;
debugs(33, 3, "parseHttpRequest: end = {" << end << "}");
- /*
- * Check that the headers don't have double-CR.
- * NP: strnstr is required so we don't search any possible binary body
blobs.
- */
- if ( squid_strnstr(req_hdr, "\r\r\n", req_sz) ) {
- debugs(33, 1, "WARNING: suspicious HTTP request contains double CR");
- hp->request_parse_status = HTTP_BAD_REQUEST;
- return parseHttpRequestAbort(conn, "error:double-CR");
- }
-
debugs(33, 3, "parseHttpRequest: prefix_sz = " <<
(int) HttpParserRequestLen(hp) << ", req_line_sz = " <<
HttpParserReqSz(hp));
// Temporary hack: We might receive a chunked body from a broken HTTP/1.1
// client that sends chunked requests to HTTP/1.0 Squid. If the request
// might have a chunked body, parse the headers early to look for the
// "Transfer-Encoding: chunked" header. If we find it, wait until the
// entire body is available so that we can set the content length and
// forward the request without chunks. The primary reason for this is
// to avoid forwarding a chunked request because the server side lacks
// logic to determine when it is valid to do so.
// FUTURE_CODE_TO_SUPPORT_CHUNKED_REQUESTS below will replace this hack.
if (hp->v_min == 1 && hp->v_maj == 1 && // broken client, may send chunks
Config.maxChunkedRequestBodySize > 0 && // configured to dechunk
(*method_p == METHOD_PUT || *method_p == METHOD_POST)) {
// check only once per request because isChunkedRequest is expensive
if (conn->in.dechunkingState == ConnStateData::chunkUnknown) {
if (isChunkedRequest(hp))
--- End Message ---
--- Begin Message ---
Source: squid3
Source-Version: 3.3.3-1
We believe that the bug you reported is fixed in the latest version of
squid3, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Luigi Gangitano <[email protected]> (supplier of updated squid3 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sun, 21 Apr 2013 23:51:11 +0200
Source: squid3
Binary: squid3 squid3-dbg squid3-common squidclient squid-cgi squid-purge
Architecture: source all i386
Version: 3.3.3-1
Distribution: unstable
Urgency: low
Maintainer: Luigi Gangitano <[email protected]>
Changed-By: Luigi Gangitano <[email protected]>
Description:
squid-cgi - Full featured Web Proxy cache (HTTP proxy) - control CGI
squid-purge - Full featured Web Proxy cache (HTTP proxy) - control utility
squid3 - Full featured Web Proxy cache (HTTP proxy)
squid3-common - Full featured Web Proxy cache (HTTP proxy) - common files
squid3-dbg - Full featured Web Proxy cache (HTTP proxy) - Debug symbols
squidclient - Full featured Web Proxy cache (HTTP proxy) - control utility
Closes: 521052 644280 656304 669148 694633 701799 702540 703954
Changes:
squid3 (3.3.3-1) unstable; urgency=low
.
* New upstream release (Closes: #694633, #701799, #702540)
- Removed upstream patches
+ debian/patches/20-ipv6-fix
+ debian/patches/30-CVE-2012-5643-CVE-2013-0189.patch
+ debian/patches/fix-701123-regression-in-cachemgr.patch
- Includes upstream fix for CVE-2009-0801 (Closes: #521052)
- Includes upstream fix for rejection of benign request containing variants
of double CR (Closes: #669148)
.
* debian/control
- Added dependency on libecap2-dev
- Added squid-purge package
.
* debian/source
- Enabled ECAP support
- Fixed configure invocation to match new syntax
- Removed unneeded rename of helper man pages
- Fixed list of helpers to build, adding fake agents (Closes: #644280)
and negotiate wrapper (Closes: #656304)
.
* debian/watch
- Updated for 3.3
.
* debian/squid3.logrotate
- Added check for existing binary in logrotate script (Closes: #703954)
Checksums-Sha1:
fe6f750473d9338dc2946c7d3d5bc13380d1800a 1475 squid3_3.3.3-1.dsc
40c2a6bdf4167d416de800ab1ded801d4142fe47 4191938 squid3_3.3.3.orig.tar.gz
be5c6fcbbef07f010deceb8ec93f5f975b5b4f50 20131 squid3_3.3.3-1.debian.tar.gz
c444a98f003ec14cbd409a041f094fda58b0be38 245408 squid3-common_3.3.3-1_all.deb
1a564b3221621c3b19e269df12afde0368c037d7 2425254 squid3_3.3.3-1_i386.deb
155ca963f3a1b6583de3e15f69a5f7ae4ca7a994 13518772 squid3-dbg_3.3.3-1_i386.deb
263bcc758f0eb06004c6a0bd3207fe7afa5e8e11 126432 squidclient_3.3.3-1_i386.deb
d02774081bf43e51f8aa81cf09358554c948bd46 129592 squid-cgi_3.3.3-1_i386.deb
c6a92711c87f8381bf3ac958fc6956f0beff3cb8 118910 squid-purge_3.3.3-1_i386.deb
Checksums-Sha256:
d0705922bb734f8a66b86e859e4bb1291e277c1894922f3e57cfeb60516c1e7b 1475
squid3_3.3.3-1.dsc
2505547a0ff5b24b9f3924a7e4ebcbfd4ce41a160b8d841331edf711c2912138 4191938
squid3_3.3.3.orig.tar.gz
6a67e847f19ee5c5084685432eb4741ec2a234d422bff0cde1d71da6fedbcd77 20131
squid3_3.3.3-1.debian.tar.gz
cd0e76f6ca35d3af7d2e116bb2e0385e5bf87bd2bcc71fcce1717c2a6b17843d 245408
squid3-common_3.3.3-1_all.deb
27402e2c23844176f9c0da0e0982b326dc8ed3fef7035c9d617b8f354c90c10d 2425254
squid3_3.3.3-1_i386.deb
3ca668f848c47516742e0fbdc2010263300c07cb398b34e9c2710a1c5ceae05e 13518772
squid3-dbg_3.3.3-1_i386.deb
9d3dc7479e3362764831f2d5624acd1abdcf49c3f169fb60900c8cf657dbba8b 126432
squidclient_3.3.3-1_i386.deb
3cb03af506e6a39b5d10483fcbb91e0b79e19a2d7dc9d2741405a4a1f800edd8 129592
squid-cgi_3.3.3-1_i386.deb
8dd0d46365b6239c39052de3133ea9da3ac7f7efce2c0ef3950c2b8f6acd7a03 118910
squid-purge_3.3.3-1_i386.deb
Files:
d4a4910d16a3b8e878712102d1ac7350 1475 web optional squid3_3.3.3-1.dsc
357eec4f49225223b5b705794da4eb26 4191938 web optional squid3_3.3.3.orig.tar.gz
b8cde55fbba8b2f047fd0b05dfca17e3 20131 web optional
squid3_3.3.3-1.debian.tar.gz
fa635b9ab57746f8b3ec94b00ab541e4 245408 web optional
squid3-common_3.3.3-1_all.deb
5f5bc35efafb795b796a2c53fbaf5243 2425254 web optional squid3_3.3.3-1_i386.deb
a1781fd9679016da7ae2a19445bacb53 13518772 debug extra
squid3-dbg_3.3.3-1_i386.deb
0f251337e21c8cb0b0723f5f70df4bd2 126432 web optional
squidclient_3.3.3-1_i386.deb
079485e7696149f326bcd1841a714f12 129592 web optional squid-cgi_3.3.3-1_i386.deb
343782a7f5dbca74688e6524c9732b05 118910 web optional
squid-purge_3.3.3-1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (Darwin)
iEYEARECAAYFAlF0ZIUACgkQ8ZumGJJMDCaDTACeIsJqwX4yM6xdUIGYlDrEUpxU
CSYAn1Sy/UPccvclzTdGktdzqKRNtLfm
=G2Xg
-----END PGP SIGNATURE-----
--- End Message ---
