From: Eric Covener Date: Mon, 14 Jul 2014 20:18:26 +0000 (+0000) Subject: merge r1535125 and r1610509 from trunk: X-Git-Tag: 2.4.10~21 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1415ef968aa05decf331bd7de10ef9d96f62eb14;p=apache merge r1535125 and r1610509 from trunk: *) SECURITY: CVE-2014-0231 (cve.mitre.org) mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes filling up the scoreboard and eventually hanging the server. [Rainer Jung, Eric Covener, Yann Ylavic] Submitted By: rjung, covener, ylavic Reviewed By: trawick, jorton, covener, jim git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1610512 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/CHANGES b/CHANGES index bc3cd4a7f0..190d12ff6a 100644 --- a/CHANGES +++ b/CHANGES @@ -13,6 +13,12 @@ Changes with Apache 2.4.10 DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and DeflateInflateRatioBurst. [Yann Ylavic, Eric Covener] + *) SECURITY: CVE-2014-0231 (cve.mitre.org) + mod_cgid: Fix a denial of service against CGI scripts that do + not consume stdin that could lead to lingering HTTPD child processes + filling up the scoreboard and eventually hanging the server. + [Rainer Jung, Eric Covener, Yann Ylavic] + *) mod_ssl: Extend the scope of SSLSessionCacheTimeout to sessions resumed by TLS session resumption (RFC 5077). [Rainer Jung] diff --git a/docs/manual/mod/mod_cgid.xml b/docs/manual/mod/mod_cgid.xml index d49bcc2a72..a901ebb5d0 100644 --- a/docs/manual/mod/mod_cgid.xml +++ b/docs/manual/mod/mod_cgid.xml @@ -102,5 +102,32 @@ the cgi daemon + +CGIDScriptTimeout +The length of time to wait for more output from the +CGI program +CGIDScriptTimeout time[s|ms] +value of Timeout directive when +unset +server config +virtual hostdirectory +.htaccess +CGIDScriptTimeout defaults to zero in releases 2.4 and earlier + + + +

This directive limits the length of time to wait for more output from + the CGI program. If the time is exceeded, the request and CGI are + terminated.

+ + Example + + CGIDScriptTimeout 20 + + + + + + diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c index 499e37dc6f..5cf548818f 100644 --- a/modules/generators/mod_cgid.c +++ b/modules/generators/mod_cgid.c @@ -97,6 +97,10 @@ static apr_socklen_t server_addr_len; static pid_t parent_pid; static ap_unix_identity_t empty_ugid = { (uid_t)-1, (gid_t)-1, -1 }; +typedef struct { + apr_interval_time_t timeout; +} cgid_dirconf; + /* The APR other-child API doesn't tell us how the daemon exited * (SIGSEGV vs. exit(1)). The other-child maintenance function * needs to decide whether to restart the daemon after a failure @@ -968,7 +972,14 @@ static void *merge_cgid_config(apr_pool_t *p, void *basev, void *overridesv) return overrides->logname ? overrides : base; } +static void *create_cgid_dirconf(apr_pool_t *p, char *dummy) +{ + cgid_dirconf *c = (cgid_dirconf *) apr_pcalloc(p, sizeof(cgid_dirconf)); + return c; +} + static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg) + { server_rec *s = cmd->server; cgid_server_conf *conf = ap_get_module_config(s->module_config, @@ -1021,7 +1032,16 @@ static const char *set_script_socket(cmd_parms *cmd, void *dummy, const char *ar return NULL; } +static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg) +{ + cgid_dirconf *dc = dummy; + if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) { + return "CGIDScriptTimeout has wrong format"; + } + + return NULL; +} static const command_rec cgid_cmds[] = { AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF, @@ -1033,6 +1053,10 @@ static const command_rec cgid_cmds[] = AP_INIT_TAKE1("ScriptSock", set_script_socket, NULL, RSRC_CONF, "the name of the socket to use for communication with " "the cgi daemon."), + AP_INIT_TAKE1("CGIDScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF, + "The amount of time to wait between successful reads from " + "the CGI script, in seconds."), + {NULL} }; @@ -1356,12 +1380,16 @@ static int cgid_handler(request_rec *r) apr_file_t *tempsock; struct cleanup_script_info *info; apr_status_t rv; + cgid_dirconf *dc; if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; } conf = ap_get_module_config(r->server->module_config, &cgid_module); + dc = ap_get_module_config(r->per_dir_config, &cgid_module); + + is_included = !strcmp(r->protocol, "INCLUDED"); if ((argv0 = strrchr(r->filename, '/')) != NULL) { @@ -1441,6 +1469,12 @@ static int cgid_handler(request_rec *r) */ apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool); + if (dc->timeout > 0) { + apr_file_pipe_timeout_set(tempsock, dc->timeout); + } + else { + apr_file_pipe_timeout_set(tempsock, r->server->timeout); + } apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket); /* Transfer any put/post args, CERN style... @@ -1517,6 +1551,10 @@ static int cgid_handler(request_rec *r) if (rv != APR_SUCCESS) { /* silly script stopped reading, soak up remaining message */ child_stopped_reading = 1; + ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, + "Error writing request body to script %s", + r->filename); + } } apr_brigade_cleanup(bb); @@ -1610,7 +1648,13 @@ static int cgid_handler(request_rec *r) return HTTP_MOVED_TEMPORARILY; } - ap_pass_brigade(r->output_filters, bb); + rv = ap_pass_brigade(r->output_filters, bb); + if (rv != APR_SUCCESS) { + /* APLOG_ERR because the core output filter message is at error, + * but doesn't know it's passing CGI output + */ + ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(02550) "Failed to flush CGI output to client"); + } } if (nph) { @@ -1741,6 +1785,8 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, request_rec *r = f->r; cgid_server_conf *conf = ap_get_module_config(r->server->module_config, &cgid_module); + cgid_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgid_module); + struct cleanup_script_info *info; add_ssi_vars(r); @@ -1770,6 +1816,13 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, * get rid of the cleanup we registered when we created the socket. */ apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool); + if (dc->timeout > 0) { + apr_file_pipe_timeout_set(tempsock, dc->timeout); + } + else { + apr_file_pipe_timeout_set(tempsock, r->server->timeout); + } + apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket); APR_BRIGADE_INSERT_TAIL(bb, apr_bucket_pipe_create(tempsock, @@ -1875,7 +1928,7 @@ static void register_hook(apr_pool_t *p) AP_DECLARE_MODULE(cgid) = { STANDARD20_MODULE_STUFF, - NULL, /* dir config creater */ + create_cgid_dirconf, /* dir config creater */ NULL, /* dir merger --- default is to override */ create_cgid_config, /* server config */ merge_cgid_config, /* merge server config */