Skip to content

http: adding another smuggling test#15244

Merged
alyssawilk merged 3 commits intoenvoyproxy:mainfrom
alyssawilk:smuggling
Mar 3, 2021
Merged

http: adding another smuggling test#15244
alyssawilk merged 3 commits intoenvoyproxy:mainfrom
alyssawilk:smuggling

Conversation

@alyssawilk
Copy link
Copy Markdown
Contributor

Making sure T-E + C-L checks handle tab based whitespace.

Risk Level: n/e (test only)
Testing: n/a
Docs Changes: n/a
Release Notes: n/a

Signed-off-by: Alyssa Wilk <alyssar@chromium.org>
Signed-off-by: Alyssa Wilk <alyssar@chromium.org>
Copy link
Copy Markdown
Contributor

@antoniovicente antoniovicente left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the extra tests for smuggling cases.

{
std::string response;
const std::string full_request = "GET / HTTP/1.1\r\nHost: host\r\ncontent-length: "
"36\r\n\ttransfer-encoding: chunked\r\n\r\n" +
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it be possible to break this request string at \r\n boundaries?

Something like:

"GET / HTTP/1.1\r\n"
"Host: host\r\n"
"content-length: 36\r\n"
"\ttransfer-encoding: chunked\r\n\r\n"

It took me a while to figure out that the difference between this request and the one above is the \t just before transfer-encoding. A comment about this being about \t would be helpful.

Also, consider a test of transfer-encoding with \t before it but no content-length, and \t before content-length and no transfer-encoding header.

}
{
std::string response;
const std::string full_request = "GET / HTTP/1.1\r\nHost: host\r\ncontent-length: "
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that in order to smuggle a request you need either content-length: 0 and possibly a request body that is chunk encoded prior to the smuggled request. A 400 here could be due to the request not being chunk encoded despite there being a transfer-encoding: chunked header.

EXPECT_THAT(response, StartsWith("HTTP/1.1 400 Bad Request\r\n"));
}
{
std::string response;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, do we have smuggling tests that use HTTP methods that can have body; for example POST.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GET can have body in Envoy :-/

Signed-off-by: Alyssa Wilk <alyssar@chromium.org>
Copy link
Copy Markdown
Contributor

@antoniovicente antoniovicente left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the extra tests.

@alyssawilk alyssawilk merged commit 98c9dc7 into envoyproxy:main Mar 3, 2021
@alyssawilk alyssawilk deleted the smuggling branch August 18, 2021 13:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants