Proxy Protocol v2 Header Parse Can Fail
- Dominant language
- C++
- Stars
- 2k
- Forks
- 874
- Avg merge
- 6d 15h
- Merged PRs (30d)
- 46
Description
The function `NetVConnection::has_proxy_protocol(IOBufferReader *reader)` attempts to detect and consume a Proxy Protocol header from an `IOBufferReader`. It does this by peeking into the reader using `memcpy` into a fixed-size stack buffer:
https://github.com/apache/trafficserver/blob/e3ec7827e720e691a57f524b1c455609ea7792c8/src/iocore/net/NetVConnection.cc#L54-L60
The size of `buf` is based on `PPv1_CONNECTION_HEADER_LEN_MAX` (108 bytes). While this is sufficient for Proxy Protocol v1, Proxy Protocol v2 headers can be significantly larger. The v2 header includes a length field, and the total size (16 + len) can exceed 108 bytes. For example, with Unix sockets:
```
struct
{ /* for AF_UNIX sockets, len = 216 */
uint8_t src_addr[108];
uint8_t dst_addr[108];
} unix_addr;
```
This is problematic because ProtocolProbeTrampoline relies on `has_proxy_protocol` during initial connection setup to detect the protocol. Consequently, valid Proxy Protocol v2 connections using headers larger than ~108 bytes may fail protocol detection.
Contributor guide
Assessment
This issue has not been assessed yet.