You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@trafficserver.apache.org by "bneradt (via GitHub)" <gi...@apache.org> on 2026/04/02 01:50:35 UTC
[PR] Reject malformed Host header ports [trafficserver]
bneradt opened a new pull request, #13050:
URL: https://github.com/apache/trafficserver/pull/13050
Reject malformed Host field authorities before ATS reuses them as request targets or cached host state. Shared Host parsing now requires host or host:port syntax, enforces bracketed IPv6 when a port is present, and rejects invalid or out-of-range ports.
This patch adds http_parse_host_header, a new host parser function which also validates the required host header format. The patch also updates the various host header parsing logic blocks across ATS to use the new parser.
Fixes: #13049
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Reject malformed Host header ports [trafficserver]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #13050:
URL: https://github.com/apache/trafficserver/pull/13050#discussion_r3025492553
##########
tests/gold_tests/headers/replays/malformed_host_port.replay.yaml:
##########
@@ -0,0 +1,85 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+meta:
+ version: "1.0"
+
+autest:
+ description: 'Reject malformed Host headers with multiple port separators'
+
+ server:
+ name: 'server'
+
+ client:
+ name: 'client'
+
+ ats:
+ name: 'ts'
+
+ process_config:
+ enable_cache: false
+
+ records_config:
+ proxy.config.diags.debug.enabled: 1
+ proxy.config.diags.debug.tags: 'http'
+
+ remap_config:
+ - from: "/"
+ to: "http://127.0.0.1:{SERVER_HTTP_PORT}/"
+
+sessions:
+- transactions:
+ - client-request:
+ method: GET
+ version: '1.1'
+ url: /malformed-host
+ headers:
+ fields:
+ - [Host, "example.com:8080:9090:1234"]
+ - [uuid, malformed-host]
+
+ # This malformed request should be rejected by ATS before reaching origin.
+ # If ATS forwards it anyway, the origin will reply 200 and the test will
+ # fail because the proxy response is expected to be 400.
+ server-response:
+ status: 200
+ reason: OK
+ headers:
+ fields:
+ - [Content-Length, "0"]
+
+ proxy-response:
+ status: 400
+
+- transactions:
+ - client-request:
+ method: GET
+ version: '1.1'
+ url: /healthy-afterward
+ headers:
+ fields:
+ - [Host, example.com]
+ - [uuid, healthy-afterward]
+
+ server-response:
+ status: 200
+ reason: OK
+ headers:
+ fields:
+ - [Content-Length, "0"]
+
+ proxy-response:
+ status: 200
Review Comment:
The YAML structure under `sessions:` is not indented, so `- transactions:` is at the document root instead of being a value of `sessions`. This will make the replay file invalid YAML and the test won't run; indent the sequence items under `sessions:` (and subsequent nested lists accordingly).
```suggestion
- transactions:
- client-request:
method: GET
version: '1.1'
url: /malformed-host
headers:
fields:
- [Host, "example.com:8080:9090:1234"]
- [uuid, malformed-host]
# This malformed request should be rejected by ATS before reaching origin.
# If ATS forwards it anyway, the origin will reply 200 and the test will
# fail because the proxy response is expected to be 400.
server-response:
status: 200
reason: OK
headers:
fields:
- [Content-Length, "0"]
proxy-response:
status: 400
- transactions:
- client-request:
method: GET
version: '1.1'
url: /healthy-afterward
headers:
fields:
- [Host, example.com]
- [uuid, healthy-afterward]
server-response:
status: 200
reason: OK
headers:
fields:
- [Content-Length, "0"]
proxy-response:
status: 200
```
##########
tests/gold_tests/headers/replays/malformed_host_port.replay.yaml:
##########
@@ -0,0 +1,85 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+meta:
+ version: "1.0"
+
+autest:
+ description: 'Reject malformed Host headers with multiple port separators'
+
+ server:
+ name: 'server'
+
+ client:
+ name: 'client'
+
+ ats:
+ name: 'ts'
+
+ process_config:
+ enable_cache: false
+
+ records_config:
+ proxy.config.diags.debug.enabled: 1
+ proxy.config.diags.debug.tags: 'http'
+
+ remap_config:
+ - from: "/"
+ to: "http://127.0.0.1:{SERVER_HTTP_PORT}/"
+
+sessions:
+- transactions:
+ - client-request:
+ method: GET
+ version: '1.1'
+ url: /malformed-host
+ headers:
+ fields:
+ - [Host, "example.com:8080:9090:1234"]
+ - [uuid, malformed-host]
+
Review Comment:
In the first transaction, `headers: fields:` is followed by `- [Host, ...]` at the same indentation level as `fields:`. YAML requires list entries to be indented under the key, otherwise the replay will not parse; indent the `fields` list items under `fields:`.
##########
tests/gold_tests/headers/replays/malformed_host_port.replay.yaml:
##########
@@ -0,0 +1,85 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+meta:
+ version: "1.0"
+
+autest:
+ description: 'Reject malformed Host headers with multiple port separators'
+
+ server:
+ name: 'server'
+
+ client:
+ name: 'client'
+
+ ats:
+ name: 'ts'
+
+ process_config:
+ enable_cache: false
+
+ records_config:
+ proxy.config.diags.debug.enabled: 1
+ proxy.config.diags.debug.tags: 'http'
+
+ remap_config:
+ - from: "/"
+ to: "http://127.0.0.1:{SERVER_HTTP_PORT}/"
+
+sessions:
+- transactions:
+ - client-request:
+ method: GET
+ version: '1.1'
+ url: /malformed-host
+ headers:
+ fields:
+ - [Host, "example.com:8080:9090:1234"]
+ - [uuid, malformed-host]
+
+ # This malformed request should be rejected by ATS before reaching origin.
+ # If ATS forwards it anyway, the origin will reply 200 and the test will
+ # fail because the proxy response is expected to be 400.
+ server-response:
+ status: 200
+ reason: OK
+ headers:
+ fields:
+ - [Content-Length, "0"]
+
+ proxy-response:
+ status: 400
+
+- transactions:
+ - client-request:
+ method: GET
+ version: '1.1'
+ url: /healthy-afterward
+ headers:
+ fields:
+ - [Host, example.com]
+ - [uuid, healthy-afterward]
Review Comment:
Same indentation issue in the second transaction: the `fields` list items under `headers: fields:` need to be indented under `fields:` for valid YAML.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Reject malformed Host header ports [trafficserver]
Posted by "bneradt (via GitHub)" <gi...@apache.org>.
bneradt merged PR #13050:
URL: https://github.com/apache/trafficserver/pull/13050
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Reject malformed Host header ports [trafficserver]
Posted by "bneradt (via GitHub)" <gi...@apache.org>.
bneradt commented on code in PR #13050:
URL: https://github.com/apache/trafficserver/pull/13050#discussion_r3029632654
##########
tests/gold_tests/headers/replays/malformed_host_port.replay.yaml:
##########
@@ -0,0 +1,85 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+meta:
+ version: "1.0"
+
+autest:
+ description: 'Reject malformed Host headers with multiple port separators'
+
+ server:
+ name: 'server'
+
+ client:
+ name: 'client'
+
+ ats:
+ name: 'ts'
+
+ process_config:
+ enable_cache: false
+
+ records_config:
+ proxy.config.diags.debug.enabled: 1
+ proxy.config.diags.debug.tags: 'http'
+
+ remap_config:
+ - from: "/"
+ to: "http://127.0.0.1:{SERVER_HTTP_PORT}/"
+
+sessions:
+- transactions:
+ - client-request:
+ method: GET
+ version: '1.1'
+ url: /malformed-host
+ headers:
+ fields:
+ - [Host, "example.com:8080:9090:1234"]
+ - [uuid, malformed-host]
+
Review Comment:
Same. No extra indentation is needed since it is under `fields:`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Reject malformed Host header ports [trafficserver]
Posted by "cmcfarlen (via GitHub)" <gi...@apache.org>.
cmcfarlen commented on PR #13050:
URL: https://github.com/apache/trafficserver/pull/13050#issuecomment-4193300939
Cherry-picked to 10.2.x
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Reject malformed Host header ports [trafficserver]
Posted by "bneradt (via GitHub)" <gi...@apache.org>.
bneradt commented on code in PR #13050:
URL: https://github.com/apache/trafficserver/pull/13050#discussion_r3029631064
##########
tests/gold_tests/headers/replays/malformed_host_port.replay.yaml:
##########
@@ -0,0 +1,85 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+meta:
+ version: "1.0"
+
+autest:
+ description: 'Reject malformed Host headers with multiple port separators'
+
+ server:
+ name: 'server'
+
+ client:
+ name: 'client'
+
+ ats:
+ name: 'ts'
+
+ process_config:
+ enable_cache: false
+
+ records_config:
+ proxy.config.diags.debug.enabled: 1
+ proxy.config.diags.debug.tags: 'http'
+
+ remap_config:
+ - from: "/"
+ to: "http://127.0.0.1:{SERVER_HTTP_PORT}/"
+
+sessions:
+- transactions:
+ - client-request:
+ method: GET
+ version: '1.1'
+ url: /malformed-host
+ headers:
+ fields:
+ - [Host, "example.com:8080:9090:1234"]
+ - [uuid, malformed-host]
+
+ # This malformed request should be rejected by ATS before reaching origin.
+ # If ATS forwards it anyway, the origin will reply 200 and the test will
+ # fail because the proxy response is expected to be 400.
+ server-response:
+ status: 200
+ reason: OK
+ headers:
+ fields:
+ - [Content-Length, "0"]
+
+ proxy-response:
+ status: 400
+
+- transactions:
+ - client-request:
+ method: GET
+ version: '1.1'
+ url: /healthy-afterward
+ headers:
+ fields:
+ - [Host, example.com]
+ - [uuid, healthy-afterward]
+
+ server-response:
+ status: 200
+ reason: OK
+ headers:
+ fields:
+ - [Content-Length, "0"]
+
+ proxy-response:
+ status: 200
Review Comment:
This is not true. Since it is under `sessions:`, no extra indentation is needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org