apache / apache/trafficserver

Proxy Protocol v2 Header Parse Can Fail

Open
#12,191 3 comments 0 reactions 0 assignees View on GitHub
Bug PROXY Protocol
Dominant language
C++
Stars
2k
Forks
874
Avg merge
6d 15h
Merged PRs (30d)
46

Description

The function `NetVConnection::has_proxy_protocol(IOBufferReader *reader)` attempts to detect and consume a Proxy Protocol header from an `IOBufferReader`. It does this by peeking into the reader using `memcpy` into a fixed-size stack buffer:

https://github.com/apache/trafficserver/blob/e3ec7827e720e691a57f524b1c455609ea7792c8/src/iocore/net/NetVConnection.cc#L54-L60

The size of `buf` is based on `PPv1_CONNECTION_HEADER_LEN_MAX` (108 bytes). While this is sufficient for Proxy Protocol v1, Proxy Protocol v2 headers can be significantly larger. The v2 header includes a length field, and the total size (16 + len) can exceed 108 bytes. For example, with Unix sockets:

```
struct
{ /* for AF_UNIX sockets, len = 216 */
uint8_t src_addr[108];
uint8_t dst_addr[108];
} unix_addr;
```

This is problematic because ProtocolProbeTrampoline relies on `has_proxy_protocol` during initial connection setup to detect the protocol. Consequently, valid Proxy Protocol v2 connections using headers larger than ~108 bytes may fail protocol detection.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.