Skip to content

Commit f480c1b

Browse files
committed
Fix set-status crash inside if/endif at remap time
Operators inside an if/endif block never had set_hook() called on them, so _hook retained its default value of TS_HTTP_READ_RESPONSE_HDR_HOOK. When set-status executed at REMAP_PSEUDO_HOOK time, exec() took the response-hook branch and called TSHttpHdrStatusSet on a request buffer, corrupting the header union and crashing. Fix the operator to check TSHttpHdrTypeGet() at runtime instead of trusting get_hook(). Removed _hook and get_hook() from operators. set_hook() becomes is_hook_valid() in Statement and RuleSet to only validate hook compatibility without mutating _hook. Upgrade the HTTPHdr::status_set/reason_set asserts to release_assert so that writing response fields into a request buffer is caught immediately rather than silently corrupting memory. Includes an autest that reproduces the crash scenario: set-status 403 inside an if/endif block under REMAP_PSEUDO_HOOK.
1 parent efeeffa commit f480c1b

2 files changed

Lines changed: 58 additions & 0 deletions

File tree

tests/gold_tests/pluginTest/header_rewrite/header_rewrite_bundle.replay.yaml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,13 @@ autest:
176176
args:
177177
- "rules/rule_session_vars.conf"
178178

179+
- from: "http://www.example.com/from_18/"
180+
to: "http://backend.ex:{SERVER_HTTP_PORT}/to_18/"
181+
plugins:
182+
- name: "header_rewrite.so"
183+
args:
184+
- "rules/set_status_in_if.conf"
185+
179186
log_validation:
180187
traffic_out:
181188
excludes:
@@ -1880,3 +1887,27 @@ sessions:
18801887
headers:
18811888
fields:
18821889
- [ X-Session-Seen, { value: "yes", as: equal } ]
1890+
1891+
# Test 67: set-status inside if/endif at REMAP_PSEUDO_HOOK time.
1892+
# Before the fix, the set-status operator inside an if/endif block retained
1893+
# its default _hook (TS_HTTP_READ_RESPONSE_HDR_HOOK), so exec() called
1894+
# TSHttpHdrStatusSet on a request buffer, corrupting the union and crashing.
1895+
- transactions:
1896+
- client-request:
1897+
method: "GET"
1898+
version: "1.1"
1899+
url: /from_18/test
1900+
headers:
1901+
fields:
1902+
- [ Host, www.example.com ]
1903+
- [ uuid, 67 ]
1904+
1905+
server-response:
1906+
status: 200
1907+
reason: OK
1908+
headers:
1909+
fields:
1910+
- [ Connection, close ]
1911+
1912+
proxy-response:
1913+
status: 403
Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one
3+
# or more contributor license agreements. See the NOTICE file
4+
# distributed with this work for additional information
5+
# regarding copyright ownership. The ASF licenses this file
6+
# to you under the Apache License, Version 2.0 (the
7+
# "License"); you may not use this file except in compliance
8+
# with the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing, software
13+
# distributed under the License is distributed on an "AS IS" BASIS,
14+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
# See the License for the specific language governing permissions and
16+
# limitations under the License.
17+
#
18+
# Minimal reproduction for set-status inside if/endif at remap time.
19+
# Before the fix, the operator's _hook defaulted to
20+
# TS_HTTP_READ_RESPONSE_HDR_HOOK, so exec() called TSHttpHdrStatusSet
21+
# on a request buffer, corrupting the header union and crashing.
22+
#
23+
cond %{REMAP_PSEUDO_HOOK}
24+
if
25+
cond %{CLIENT-URL:PATH} /from_18/
26+
set-status 403
27+
endif

0 commit comments

Comments
 (0)