passenger 6.2.1 → 6.2.2

data/src/apache2_module/Hooks.cpp

@@ -612,6 +612,19 @@ private:
 			return ReportFileSystemError(e).report(r);
 		}
 
+		/* These values can contain request-derived data. For example, the
+		 * document root can be computed by mod_vhost_alias, mod_auth_form
+		 * URL-decodes the user name, and mod_authn_anon can accept any user name.
+		 */
+		if (containsHeaderDelimiter(ap_document_root(r))) {
+			P_WARN("Rejecting request because the document root contains a CR or LF character");
+			return HTTP_BAD_REQUEST;
+		}
+		if (containsHeaderDelimiter(r->user)) {
+			P_WARN("Rejecting request because the authenticated user name contains a CR or LF character");
+			return HTTP_BAD_REQUEST;
+		}
+
 
 		UPDATE_TRACE_POINT();
 		try {

data/src/apache2_module/Utils.h

@@ -27,6 +27,7 @@
 #define _PASSENGER_APACHE2_MODULE_UTILS_H_
 
 #include <string>
+#include <cstring>
 #include <boost/function.hpp>
 #include <StaticString.h>
 
@@ -67,6 +68,19 @@ typedef boost::function<void (
 )> DirConfigTraverser;
 
 
+/**
+ * Whether `value` contains a CR or LF. The request that we send to the Core is
+ * a CRLF-delimited HTTP header block. The Core trusts every secure header
+ * ("!~" prefix) that comes after the Core password header. So if a
+ * request-derived value that we serialize as a secure header contains CR or LF,
+ * then the client can inject arbitrary secure headers, such as an app start
+ * command. Such values must be rejected.
+ */
+inline bool
+containsHeaderDelimiter(const char *value) {
+	return value != NULL && strpbrk(value, "\r\n") != NULL;
+}
+
 inline void
 addHeader(string &headers, const StaticString &name, const char *value) {
 	if (value != NULL) {

data/src/cxx_supportlib/Constants.h

@@ -84,7 +84,7 @@
 #define PASSENGER_API_VERSION_MAJOR 0
 #define PASSENGER_API_VERSION_MINOR 3
 #define PASSENGER_DEFAULT_USER "nobody"
-#define PASSENGER_VERSION "6.2.1"
+#define PASSENGER_VERSION "6.2.2"
 #define POOL_HELPER_THREAD_STACK_SIZE 262144
 #define PROCESS_SHUTDOWN_TIMEOUT 60
 #define PROCESS_SHUTDOWN_TIMEOUT_DISPLAY "1 minute"

data/src/cxx_supportlib/FileTools/FileManip.cpp

@@ -252,8 +252,12 @@ makeDirTree(const string &path, const StaticString &mode, uid_t owner, gid_t gro
 	for (rit = paths.rbegin(); rit != paths.rend(); rit++) {
 		current = *rit;
 
+		/* Create the directory accessible only to us. We need to open() it
+		 * below, which requires read permission that the requested mode may
+		 * not grant. The fchmod() below applies the requested mode.
+		 */
 		do {
-			ret = mkdir(current.c_str(), modeBits);
+			ret = mkdir(current.c_str(), S_IRWXU);
 		} while (ret == -1 && errno == EINTR);
 		if (ret == -1) {
 			if (errno == EEXIST) {
@@ -266,9 +270,29 @@ makeDirTree(const string &path, const StaticString &mode, uid_t owner, gid_t gro
 			}
 		}
 
+		FileDescriptor fd;
+		int options = O_DIRECTORY | O_NOFOLLOW;
+		do {
+			fd.assign(open(current.c_str(), options, modeBits), __FILE__, __LINE__);
+		} while (fd == -1 && errno == EINTR);
+		if (fd == -1) {
+			int e = errno;
+			throw FileSystemException("Cannot open newly created directory, (possible symlink attack) " +
+				current, e, current);
+		}
+		struct stat buf;
+		if (fstat(fd, &buf) == -1) {
+			int e = errno;
+			throw FileSystemException("Cannot stat newly created directory, (possible symlink attack) " +
+				current, e, current);
+		} else if (!S_ISDIR(buf.st_mode)) {
+			throw FileSystemException("Newly created directory was replaced before opening occurred, (possible symlink attack) " +
+				current, ENOTDIR, current);
+		}
+
 		/* Chmod in order to override the umask. */
 		do {
-			ret = chmod(current.c_str(), modeBits);
+			ret = fchmod(fd, modeBits);
 		} while (ret == -1 && errno == EINTR);
 
 		if (owner != USER_NOT_GIVEN && group != GROUP_NOT_GIVEN) {
@@ -279,7 +303,7 @@ makeDirTree(const string &path, const StaticString &mode, uid_t owner, gid_t gro
 				group = (gid_t) -1; // Don't let chown change file group.
 			}
 			do {
-				ret = lchown(current.c_str(), owner, group);
+				ret = fchown(fd, owner, group);
 			} while (ret == -1 && errno == EINTR);
 			if (ret == -1) {
 				char message[1024];

data/src/cxx_supportlib/InstanceDirectory.h

@@ -92,7 +92,8 @@ private:
 	}
 
 	static bool createPath(const string &registryDir, const string &path) {
-		if (mkdir(path.c_str(), parseModeString("u=rwx,g=rx,o=rx")) == -1) {
+		mode_t permissions = parseModeString("u=rwx,g=rx,o=rx");
+		if (mkdir(path.c_str(), permissions) == -1) {
 			if (errno == EEXIST) {
 				return false;
 			} else {
@@ -101,15 +102,41 @@ private:
 					" instance registry directory " + registryDir, e, registryDir);
 			}
 		}
+		FileDescriptor fd;
+		int options = O_DIRECTORY | O_NOFOLLOW;
+		do {
+			fd.assign(open(path.c_str(), options, permissions), __FILE__, __LINE__);
+		} while (fd == -1 && errno == EINTR);
+		if (fd == -1) {
+			int e = errno;
+			throw FileSystemException("Cannot open newly created instance directory, (possible symlink attack) " +
+				path, e, path);
+		}
+		struct stat buf;
+		if (fstat(fd, &buf) == -1) {
+			int e = errno;
+			throw FileSystemException("Cannot stat newly created instance directory, (possible symlink attack) " +
+				path, e, path);
+		} else if (!S_ISDIR(buf.st_mode)) {
+			throw FileSystemException("Newly created instance directory was replaced before opening occurred, (possible symlink attack) " +
+				path, ENOTDIR, path);
+		}
+		int ret = 0;
 		// Explicitly chmod the directory in case the umask is interfering.
-		if (chmod(path.c_str(), parseModeString("u=rwx,g=rx,o=rx")) == -1) {
+		do {
+			ret = fchmod(fd, permissions);
+		} while (ret == -1 && errno == EINTR);
+		if (ret == -1) {
 			int e = errno;
 			throw FileSystemException("Cannot set permissions on instance directory " +
 				path, e, path);
 		}
 		// The parent directory may have the setgid bit enabled, so we
 		// explicitly chown it.
-		if (chown(path.c_str(), geteuid(), getegid()) == -1) {
+		do {
+			ret = fchown(fd, geteuid(), getegid());
+		} while (ret == -1 && errno == EINTR);
+		if (ret == -1) {
 			int e = errno;
 			throw FileSystemException("Cannot change the permissions of the instance "
 				"directory " + path, e, path);

data/src/cxx_supportlib/ServerKit/Errors.h

@@ -27,7 +27,7 @@
 #define _PASSENGER_SERVER_KIT_ERRORS_H_
 
 #include <cstring>
-#include <ServerKit/llhttp.h>
+#include <llhttp/llhttp.h>
 #include <ServerKit/llerrors.h>
 
 namespace Passenger {

data/src/cxx_supportlib/ServerKit/HttpHeaderParser.h

@@ -31,7 +31,7 @@
 #include <cstddef>
 #include <cstring>
 #include <MemoryKit/mbuf.h>
-#include <ServerKit/llhttp.h>
+#include <llhttp/llhttp.h>
 #include <ServerKit/Context.h>
 #include <ServerKit/HttpRequest.h>
 #include <ServerKit/HttpHeaderParserState.h>

data/src/cxx_supportlib/ServerKit/HttpHeaderParserState.h

@@ -28,7 +28,7 @@
 
 #include <DataStructures/LString.h>
 #include <Algorithms/Hasher.h>
-#include <ServerKit/llhttp.h>
+#include <llhttp/llhttp.h>
 #include <ServerKit/HeaderTable.h>
 
 namespace Passenger {

data/src/cxx_supportlib/ServerKit/HttpRequest.h

@@ -29,7 +29,7 @@
 #include <psg_sysqueue.h>
 #include <boost/cstdint.hpp>
 #include <boost/atomic.hpp>
-#include <ServerKit/llhttp.h>
+#include <llhttp/llhttp.h>
 #include <ServerKit/Hooks.h>
 #include <ServerKit/Client.h>
 #include <ServerKit/HeaderTable.h>

data/src/cxx_supportlib/ServerKit/llerrors.h

@@ -1,7 +1,7 @@
 #ifndef INCLUDE_LLERRORS_H_
 #define INCLUDE_LLERRORS_H_
 
-#include <ServerKit/llhttp.h>
+#include <llhttp/llhttp.h>
 
 inline const char *llhttp_get_error_description(llhttp_errno_t error) {
 	switch (error) {
@@ -77,8 +77,8 @@ inline const char *llhttp_get_error_description(llhttp_errno_t error) {
 		return "the on_chunk_complete callback failed";
 	case HPE_CB_RESET:
 		return "the on_reset callback failed";
-	default:
-		return "unknown error";
+	case HPE_CB_PROTOCOL_COMPLETE:
+		return "the on_protocol_complete callback failed";
 	}
 }
 #endif

data/src/cxx_supportlib/ServerKit/llversion.h

@@ -1,7 +1,7 @@
 #ifndef INCLUDE_LLVERSION_H_
 #define INCLUDE_LLVERSION_H_
 
-#include <ServerKit/llhttp.h>
+#include <llhttp/llhttp.h>
 #include <boost/preprocessor/stringize.hpp>
 
 inline const char *llhttp_version() {

data/src/cxx_supportlib/{ServerKit/llhttp_api.c → vendor-copy/llhttp/api.c}

@@ -57,29 +57,14 @@ static int wasm_on_headers_complete_wrap(llhttp_t* p) {
 }
 
 const llhttp_settings_t wasm_settings = {
-  wasm_on_message_begin,
-  wasm_on_url,
-  wasm_on_status,
-  NULL,
-  NULL,
-  wasm_on_header_field,
-  wasm_on_header_value,
-  NULL,
-  NULL,
-  wasm_on_headers_complete_wrap,
-  wasm_on_body,
-  wasm_on_message_complete,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
+  .on_message_begin = wasm_on_message_begin,
+  .on_url = wasm_on_url,
+  .on_status = wasm_on_status,
+  .on_header_field = wasm_on_header_field,
+  .on_header_value = wasm_on_header_value,
+  .on_headers_complete = wasm_on_headers_complete_wrap,
+  .on_body = wasm_on_body,
+  .on_message_complete = wasm_on_message_complete,
 };
 
 
@@ -331,6 +316,14 @@ void llhttp_set_lenient_spaces_after_chunk_size(llhttp_t* parser, int enabled) {
   }
 }
 
+void llhttp_set_lenient_header_value_relaxed(llhttp_t* parser, int enabled) {
+  if (enabled) {
+    parser->lenient_flags |= LENIENT_HEADER_VALUE_RELAXED;
+  } else {
+    parser->lenient_flags &= ~LENIENT_HEADER_VALUE_RELAXED;
+  }
+}
+
 /* Callbacks */
 
 
@@ -341,6 +334,20 @@ int llhttp__on_message_begin(llhttp_t* s, const char* p, const char* endp) {
 }
 
 
+int llhttp__on_protocol(llhttp_t* s, const char* p, const char* endp) {
+  int err;
+  SPAN_CALLBACK_MAYBE(s, on_protocol, p, endp - p);
+  return err;
+}
+
+
+int llhttp__on_protocol_complete(llhttp_t* s, const char* p, const char* endp) {
+  int err;
+  CALLBACK_MAYBE(s, on_protocol_complete);
+  return err;
+}
+
+
 int llhttp__on_url(llhttp_t* s, const char* p, const char* endp) {
   int err;
   SPAN_CALLBACK_MAYBE(s, on_url, p, endp - p);