tree 53ee51366c3a0ff9da16facbff64b6a187187388
parent 189c008bcac457dd9d82ef41a50800ee39ea5f02
author Tim Duesterhus <tim@bastelstu.be> 1583798140 +0100
committer Christopher Faulet <cfaulet@haproxy.com> 1654581360 +0200

BUG/MEDIUM: http: Properly reject non-HTTP/1.x protocols

This patch hardens the verification of the HTTP/1.x version line
(i.e. the first line within an HTTP/1.x request) to verify that
the protocol name within the version actually reads "HTTP".

Previously protocols that superficially resembled the wire-format
of HTTP/1.x and having a 4-letter acronym as the protocol name, such
as RTSP would pass this check.

This patch fixes GitHub issue #540, it must be backported to all
supported versions. The legacy, non-HTX parser is affected as well,
a fix must be created for it as well.

Note that such protocols can still be used when option
accept-invalid-http-request is set.

(cherry picked from commit 8f4116ea6589bcf02474622f0af4baee276e56b5)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 504342d34f764ce67c860551cebdbed9cca73c56)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>