summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-webserver/recipes-httpd/apache2/apache2/CVE-2023-45802.patch141
-rw-r--r--meta-webserver/recipes-httpd/apache2/apache2_2.4.57.bb1
2 files changed, 142 insertions, 0 deletions
diff --git a/meta-webserver/recipes-httpd/apache2/apache2/CVE-2023-45802.patch b/meta-webserver/recipes-httpd/apache2/apache2/CVE-2023-45802.patch
new file mode 100644
index 0000000000..ee26e701f3
--- /dev/null
+++ b/meta-webserver/recipes-httpd/apache2/apache2/CVE-2023-45802.patch
@@ -0,0 +1,141 @@
1From decce82a706abd78dfc32821a03ad93841d7758a Mon Sep 17 00:00:00 2001
2From: Stefan Eissing <icing@apache.org>
3Date: Mon, 16 Oct 2023 09:05:00 +0000
4Subject: [PATCH] Merge of /httpd/httpd/trunk:r1912999
5
6 * mod_http2: improved early cleanup of streams.
7
8
9
10git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913000 13f79535-47bb-0310-9956-ffa450edef68
11---
12Upstream-Status: Backport from [https://github.com/apache/httpd/commit/decce82a706abd78dfc32821a03ad93841d7758a]
13CVE: CVE-2023-45802
14Signed-off-by: Ashish Sharma <asharma@mvista.com>
15 changes-entries/h2_cleanup.txt | 2 ++
16 modules/http2/h2_mplx.c | 26 ++++++++++++++++++++++----
17 modules/http2/h2_mplx.h | 3 ++-
18 modules/http2/h2_session.c | 18 +++++++++++++++++-
19 modules/http2/h2_stream.c | 2 +-
20 5 files changed, 44 insertions(+), 7 deletions(-)
21 create mode 100644 changes-entries/h2_cleanup.txt
22
23diff --git a/changes-entries/h2_cleanup.txt b/changes-entries/h2_cleanup.txt
24new file mode 100644
25index 00000000000..5366b4adfc6
26--- /dev/null
27+++ b/changes-entries/h2_cleanup.txt
28@@ -0,0 +1,2 @@
29+ * mod_http2: improved early cleanup of streams.
30+ [Stefan Eissing]
31diff --git a/modules/http2/h2_mplx.c b/modules/http2/h2_mplx.c
32index 4637a5f66ef..2aeea42b5df 100644
33--- a/modules/http2/h2_mplx.c
34+++ b/modules/http2/h2_mplx.c
35@@ -1119,14 +1119,32 @@ static int reset_is_acceptable(h2_stream *stream)
36 return 1; /* otherwise, be forgiving */
37 }
38
39-apr_status_t h2_mplx_c1_client_rst(h2_mplx *m, int stream_id)
40+apr_status_t h2_mplx_c1_client_rst(h2_mplx *m, int stream_id, h2_stream *stream)
41 {
42- h2_stream *stream;
43 apr_status_t status = APR_SUCCESS;
44+ int registered;
45
46 H2_MPLX_ENTER_ALWAYS(m);
47- stream = h2_ihash_get(m->streams, stream_id);
48- if (stream && !reset_is_acceptable(stream)) {
49+ registered = (h2_ihash_get(m->streams, stream_id) != NULL);
50+ if (!stream) {
51+ /* a RST might arrive so late, we have already forgotten
52+ * about it. Seems ok. */
53+ ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, m->c1,
54+ H2_MPLX_MSG(m, "RST on unknown stream %d"), stream_id);
55+ AP_DEBUG_ASSERT(!registered);
56+ }
57+ else if (!registered) {
58+ /* a RST on a stream that mplx has not been told about, but
59+ * which the session knows. Very early and annoying. */
60+ ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, m->c1,
61+ H2_STRM_MSG(stream, "very early RST, drop"));
62+ h2_stream_set_monitor(stream, NULL);
63+ h2_stream_rst(stream, H2_ERR_STREAM_CLOSED);
64+ h2_stream_dispatch(stream, H2_SEV_EOS_SENT);
65+ m_stream_cleanup(m, stream);
66+ m_be_annoyed(m);
67+ }
68+ else if (!reset_is_acceptable(stream)) {
69 m_be_annoyed(m);
70 }
71 H2_MPLX_LEAVE(m);
72diff --git a/modules/http2/h2_mplx.h b/modules/http2/h2_mplx.h
73index a2e73d9d7c3..860f9160397 100644
74--- a/modules/http2/h2_mplx.h
75+++ b/modules/http2/h2_mplx.h
76@@ -201,7 +201,8 @@ int h2_mplx_c1_all_streams_want_send_data(h2_mplx *m);
77 * any processing going on and remove from processing
78 * queue.
79 */
80-apr_status_t h2_mplx_c1_client_rst(h2_mplx *m, int stream_id);
81+apr_status_t h2_mplx_c1_client_rst(h2_mplx *m, int stream_id,
82+ struct h2_stream *stream);
83
84 /**
85 * Get readonly access to a stream for a secondary connection.
86diff --git a/modules/http2/h2_session.c b/modules/http2/h2_session.c
87index 066c73ad98b..b6f6e7c01fb 100644
88--- a/modules/http2/h2_session.c
89+++ b/modules/http2/h2_session.c
90@@ -402,6 +402,10 @@ static int on_frame_recv_cb(nghttp2_session *ng2s,
91 H2_SSSN_STRM_MSG(session, frame->hd.stream_id,
92 "RST_STREAM by client, error=%d"),
93 (int)frame->rst_stream.error_code);
94+ if (stream) {
95+ rv = h2_stream_recv_frame(stream, NGHTTP2_RST_STREAM, frame->hd.flags,
96+ frame->hd.length + H2_FRAME_HDR_LEN);
97+ }
98 if (stream && stream->initiated_on) {
99 /* A stream reset on a request we sent it. Normal, when the
100 * client does not want it. */
101@@ -410,7 +414,8 @@ static int on_frame_recv_cb(nghttp2_session *ng2s,
102 else {
103 /* A stream reset on a request it sent us. Could happen in a browser
104 * when the user navigates away or cancels loading - maybe. */
105- h2_mplx_c1_client_rst(session->mplx, frame->hd.stream_id);
106+ h2_mplx_c1_client_rst(session->mplx, frame->hd.stream_id,
107+ stream);
108 }
109 ++session->streams_reset;
110 break;
111@@ -812,6 +817,17 @@ static apr_status_t session_cleanup(h2_session *session, const char *trigger)
112 "goodbye, clients will be confused, should not happen"));
113 }
114
115+ if (!h2_iq_empty(session->ready_to_process)) {
116+ int sid;
117+ ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c,
118+ H2_SSSN_LOG(APLOGNO(), session,
119+ "cleanup, resetting %d streams in ready-to-process"),
120+ h2_iq_count(session->ready_to_process));
121+ while ((sid = h2_iq_shift(session->ready_to_process)) > 0) {
122+ h2_mplx_c1_client_rst(session->mplx, sid, get_stream(session, sid));
123+ }
124+ }
125+
126 transit(session, trigger, H2_SESSION_ST_CLEANUP);
127 h2_mplx_c1_destroy(session->mplx);
128 session->mplx = NULL;
129diff --git a/modules/http2/h2_stream.c b/modules/http2/h2_stream.c
130index c419e2d8591..f6c92024519 100644
131--- a/modules/http2/h2_stream.c
132+++ b/modules/http2/h2_stream.c
133@@ -125,7 +125,7 @@ static int trans_on_event[][H2_SS_MAX] = {
134 { S_XXX, S_ERR, S_ERR, S_CL_L, S_CLS, S_XXX, S_XXX, S_XXX, },/* EV_CLOSED_L*/
135 { S_ERR, S_ERR, S_ERR, S_CL_R, S_ERR, S_CLS, S_NOP, S_NOP, },/* EV_CLOSED_R*/
136 { S_CLS, S_CLS, S_CLS, S_CLS, S_CLS, S_CLS, S_NOP, S_NOP, },/* EV_CANCELLED*/
137-{ S_NOP, S_XXX, S_XXX, S_XXX, S_XXX, S_CLS, S_CLN, S_XXX, },/* EV_EOS_SENT*/
138+{ S_NOP, S_XXX, S_XXX, S_XXX, S_XXX, S_CLS, S_CLN, S_NOP, },/* EV_EOS_SENT*/
139 { S_NOP, S_XXX, S_CLS, S_XXX, S_XXX, S_CLS, S_XXX, S_XXX, },/* EV_IN_ERROR*/
140 };
141
diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.57.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.57.bb
index 669d277567..2484f90eb6 100644
--- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.57.bb
+++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.57.bb
@@ -16,6 +16,7 @@ SRC_URI = "${APACHE_MIRROR}/httpd/httpd-${PV}.tar.bz2 \
16 file://0008-Fix-perl-install-directory-to-usr-bin.patch \ 16 file://0008-Fix-perl-install-directory-to-usr-bin.patch \
17 file://0009-support-apxs.in-force-destdir-to-be-empty-string.patch \ 17 file://0009-support-apxs.in-force-destdir-to-be-empty-string.patch \
18 file://0011-modules-mappers-config9.m4-Add-server-directory-to-i.patch \ 18 file://0011-modules-mappers-config9.m4-Add-server-directory-to-i.patch \
19 file://CVE-2023-45802.patch \
19 " 20 "
20 21
21SRC_URI:append:class-target = " \ 22SRC_URI:append:class-target = " \
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-11-01 10:38:19 +0000