Bug 207901
| Summary: | www/squid Host header forgery detection with sslbump leads to crash | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Ports & Packages | Reporter: | Christophe Anselme-Moizan <christophe.anselmemoizan> | ||||||||||||
| Component: | Individual Port(s) | Assignee: | Jason Unovitch <junovitch> | ||||||||||||
| Status: | Closed FIXED | ||||||||||||||
| Severity: | Affects Some People | CC: | fabrice.bruel, junovitch, pi, timp87 | ||||||||||||
| Priority: | --- | Keywords: | needs-qa, patch | ||||||||||||
| Version: | Latest | Flags: | pi:
maintainer-feedback+
junovitch: merge-quarterly+ |
||||||||||||
| Hardware: | amd64 | ||||||||||||||
| OS: | Any | ||||||||||||||
| Attachments: |
|
||||||||||||||
|
Description
Christophe Anselme-Moizan
2016-03-11 10:43:24 UTC
(In reply to Christophe Anselme-Moizan from comment #0) I'm sorry, but I think squid's bugzilla (http://bugs.squid-cache.org/index.cgi) is a better place to report this issue. (In reply to Christophe Anselme-Moizan from comment #0) You could try the patch from https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207762 at least. I posted on squid's bugzilla too after your comment. I will try the patch today. (In reply to timp87 from comment #2) Thanks you for your help. The patch didn't resolve my problem. I'm still facing the same issue. I'm waiting for squid's bugzilla feedback and will let you know (In reply to Christophe Anselme-Moizan from comment #4) You could provide the link to squid's bugzilla (In reply to timp87 from comment #5) http://bugs.squid-cache.org/show_bug.cgi?id=4465 I tried with STABLE, rather than RELEASE, same problem [root@FBSD10STABLE ~]# uname -a FreeBSD FBSD10STABLE 10.3-BETA2 FreeBSD 10.3-BETA2 #0 r295624: Mon Feb 15 15:49:00 CET 2016 root@aa:/usr/obj/usr/src/sys/FBSD10PF amd64 2016/03/17 10:17:23.173 kid1| SECURITY ALERT: Host header forgery detected on local=80.252.91.41:443 remote=10.0.0.2:58678 FD 55 flags=33 (local IP does not match any domain IP) FATAL: Received Segment Violation...dying. Backtrace follows (deepest frame first): #1: _pthread_sigmask + 0x51a, ip = 0x803b20b4a, sp = 0x7fffffffda70 #2: _pthread_getspecific + 0xe1c, ip = 0x803b2022c, sp = 0x7fffffffde30 #3: [unknown] + 0x0, ip = 0x7ffffffff193, sp = 0x7fffffffdeb0 #4: strlen + 0xb, ip = 0x803e7a3ab, sp = 0x7fffffffe460 #5: _ZN20ClientRequestContext22hostHeaderVerifyFailedEPKcS1_ + 0x2fe, ip = 0x571eee, sp = 0x7fffffffe470 #6: _ZN20ClientRequestContext18hostHeaderIpVerifyEPK14_ipcache_addrsRK16DnsLookupDetails + 0x3f7, ip = 0x571987, sp = 0x7fffffffe4f0 #7: _ZL15ipcacheCallbackP13ipcache_entryi + 0xc3, ip = 0x5fa6d3, sp = 0x7fffffffe5b0 #8: _ZL18ipcacheHandleReplyPvPK11_rfc1035_rriPKc + 0x1079, ip = 0x5fb7a9, sp = 0x7fffffffe620 #9: _ZL12idnsCallbackP11_idns_queryPKc + 0x5b9, ip = 0x590fa9, sp = 0x7fffffffe710 #10: _ZL13idnsGrokReplyPKcmi + 0xe47, ip = 0x5930f7, sp = 0x7fffffffe780 #11: _ZL8idnsReadiPv + 0x57d, ip = 0x58d2dd, sp = 0x7fffffffe7d0 #12: _ZN4Comm8DoSelectEi + 0x140, ip = 0x797ec0, sp = 0x7fffffffe8b0 #13: _ZN16CommSelectEngine11checkEventsEi + 0x2e, ip = 0x710f4e, sp = 0x7fffffffe900 #14: _ZN9EventLoop11checkEngineEP11AsyncEngineb + 0x2c, ip = 0x59a30c, sp = 0x7fffffffe920 #15: _ZN9EventLoop7runOnceEv + 0xa6, ip = 0x59a5e6, sp = 0x7fffffffe960 #16: _ZN9EventLoop3runEv + 0x48, ip = 0x59a528, sp = 0x7fffffffe9a0 #17: _Z9SquidMainiPPc + 0x26ad, ip = 0x600aad, sp = 0x7fffffffe9c0 #18: main + 0x14, ip = 0x5fe164, sp = 0x7fffffffec70 #19: _start + 0x16f, ip = 0x503d9f, sp = 0x7fffffffecb0 #20: [unknown] + 0x0, ip = 0x800b89000, sp = 0x7fffffffecf0 Use addr2line of similar to translate offsets to line information. CPU Usage: 33.255 seconds = 31.437 user + 1.818 sys Maximum Resident Size: 550688 KB Page faults with physical i/o: 28 The patch referenced in the URL (the take 2 patch) doesn't appear to be reflected in http://www.squid-cache.org/Versions/v3/3.5/squid-3.5.16.patch for the most recent release. Is this still needed to resolve the issue or can we ask upstream to get this in and release a 3.5.17? (In reply to Jason Unovitch from comment #8) Let's wait for a couple of days. I think they'll officially apply it for 3.5 soon. Created attachment 169422 [details]
port patch
Add all available patches, including that one which fixes 'Host header forgery detection with sslbump' problem.
Exclude squid-3.5-14026.patch because looks like it's not appropriate for 3.5
(In reply to timp87 from comment #10) Sorry, don't commit it, I'm going to provide a better patch Created attachment 169468 [details]
port patch
1. Add all available official patches up to 14030. One of these patches fixes 'header forgery detection with sslbump' problem.
2. Also add 14626 patch from squid4 which addresses "Add chained certificates and signing certificate to peek-then-bumped connections." problem.
Created attachment 169469 [details]
poudriere log
Ok, now it can be committed. Created attachment 169481 [details]
port patch up to 14031
Add all available official patches up to 14031.
It fixes two annoying and long-standing problems:
- header forgery detection leads to crash;
- add chained certificates and signing certificate to peek-then-bumped connections.
Created attachment 169482 [details]
poudriere log
I suppose this change should go to quarter branch too.
testbuilds@work Sorry, every time I have different problems with maintainer-approval flag =) testbuilds are fine A commit references this bug: Author: pi Date: Wed Apr 20 13:45:23 UTC 2016 New revision: 413688 URL: https://svnweb.freebsd.org/changeset/ports/413688 Log: www/squid: Add all available official patches up to 14031 It fixes two annoying and long-standing problems: - header forgery detection (using sslbump) leads to crash - add chained certificates and signing certificate to peek-then-bumped connections. PR: 207901 MFH: 2016Q2 Submitted by: Pavel Timofeev <timp87@gmail.com> (maintainer) Reported by: Christophe Anselme-Moizan <christophe.anselmemoizan@orange.com> Changes: head/www/squid/Makefile head/www/squid/distinfo head/www/squid/files/patch-src__ip__Intercept.cc Jason, you know my mfh handicap... (In reply to Kurt Jaeger from comment #21) Don't waste your time for this, they've just released 3.5.17 with CVE. https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=208939 Good help us :) MFH is obsolete, new version was released. A commit references this bug: Author: pi Date: Thu Apr 21 07:44:45 UTC 2016 New revision: 413719 URL: https://svnweb.freebsd.org/changeset/ports/413719 Log: MFH: r413688 r413697 www/squid: Add all available official patches up to 14031 It fixes two annoying and long-standing problems: - header forgery detection (using sslbump) leads to crash - add chained certificates and signing certificate to peek-then-bumped connections. PR: 207901 Submitted by: Pavel Timofeev <timp87@gmail.com> (maintainer) Reported by: Christophe Anselme-Moizan <christophe.anselmemoizan@orange.com> www/squid: 3.5.16 -> 3.5.17 Changes: http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID_3_5_17.html http://www.squid-cache.org/Advisories/SQUID-2016_5.txt PR: 208939 Submitted by: Pavel Timofeev <timp87@gmail.com> (maintainer) Security: CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 Approved by: ports-secteam (junovitch) Changes: _U branches/2016Q2/ branches/2016Q2/www/squid/Makefile branches/2016Q2/www/squid/distinfo branches/2016Q2/www/squid/files/patch-src__ip__Intercept.cc Set merge-quarterly+ appropriately. Kurt, thanks for taking this. I have been sidetracked with work quite a bit lately. |
