Skip to content

out_forward: process type and length of pong strictly #11945

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
edsiper merged 2 commits into from
Jun 15, 2026
Merged

out_forward: process type and length of pong strictly #11945

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
be41e6c
out_forward: Process more strict length and type checks
cosmo0920 Jun 15, 2026
444af18
tests: runtime: Add a test case for rigid handlings of helo
cosmo0920 Jun 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 53 additions & 6 deletions plugins/out_forward/forward.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -340,22 +340,39 @@ static void secure_forward_set_ping(struct flb_forward_ping *ping,
memset(ping, 0, sizeof(struct flb_forward_ping));
ping->keepalive = 1; /* default, as per spec */

if (map->type != MSGPACK_OBJECT_MAP) {
return;
}

for (i = 0; i < map->via.map.size; i++) {
key = map->via.map.ptr[i].key;
val = map->via.map.ptr[i].val;

if (key.type != MSGPACK_OBJECT_STR) {
continue;
}

ptr = key.via.str.ptr;
len = key.via.str.size;

if (len == 5 && memcmp(ptr, "nonce", len) == 0) {
if (val.type != MSGPACK_OBJECT_STR && val.type != MSGPACK_OBJECT_BIN) {
continue;
}
ping->nonce = val.via.bin.ptr;
ping->nonce_len = val.via.bin.size;
}
else if (len == 4 && memcmp(ptr, "auth", len) == 0) {
if (val.type != MSGPACK_OBJECT_STR && val.type != MSGPACK_OBJECT_BIN) {
continue;
}
ping->auth = val.via.bin.ptr;
ping->auth_len = val.via.bin.size;
}
else if (len == 9 && memcmp(ptr, "keepalive", len) == 0) {
if (val.type != MSGPACK_OBJECT_BOOLEAN) {
continue;
}
ping->keepalive = val.via.boolean;
}
}
Expand Down Expand Up @@ -549,7 +566,7 @@ static int secure_forward_pong(struct flb_forward *ctx, char *buf, int buf_size)
goto error;
}

if (strncmp(o.via.str.ptr, "PONG", 4) != 0 || o.via.str.size != 4) {
if (o.via.str.size != 4 || strncmp(o.via.str.ptr, "PONG", 4) != 0) {
goto error;
}

Expand All @@ -564,7 +581,17 @@ static int secure_forward_pong(struct flb_forward *ctx, char *buf, int buf_size)
}
else {
o = root.via.array.ptr[2];
memcpy(msg, o.via.str.ptr, o.via.str.size);
if (o.type != MSGPACK_OBJECT_STR) {
goto error;
}
if (o.via.str.size >= sizeof(msg)) {
memcpy(msg, o.via.str.ptr, sizeof(msg) - 1);
msg[sizeof(msg) - 1] = '\0';
}
else {
memcpy(msg, o.via.str.ptr, o.via.str.size);
msg[o.via.str.size] = '\0';
}
flb_plg_error(ctx->ins, "failed authorization: %s", msg);
}

Expand Down Expand Up @@ -603,6 +630,12 @@ static int secure_forward_handshake(struct flb_connection *u_conn,

/* Parse HELO message */
root = result.data;
if (root.type != MSGPACK_OBJECT_ARRAY) {
flb_plg_error(ctx->ins, "Invalid HELO type message");
msgpack_unpacked_destroy(&result);
return -1;
}

if (root.via.array.size < 2) {
flb_plg_error(ctx->ins, "Invalid HELO message");
msgpack_unpacked_destroy(&result);
Expand All @@ -616,7 +649,7 @@ static int secure_forward_handshake(struct flb_connection *u_conn,
return -1;
}

if (strncmp(o.via.str.ptr, "HELO", 4) != 0 || o.via.str.size != 4) {
if (o.via.str.size != 4 || strncmp(o.via.str.ptr, "HELO", 4) != 0) {
flb_plg_error(ctx->ins, "Invalid HELO content message");
msgpack_unpacked_destroy(&result);
return -1;
Expand All @@ -626,6 +659,12 @@ static int secure_forward_handshake(struct flb_connection *u_conn,

/* Compose and send PING message */
o = root.via.array.ptr[1];
if (o.type != MSGPACK_OBJECT_MAP) {
flb_plg_error(ctx->ins, "Invalid HELO options message");
msgpack_unpacked_destroy(&result);
return -1;
}

ret = secure_forward_ping(u_conn, o, fc, ctx);
if (ret == -1) {
flb_plg_error(ctx->ins, "Failed PING");
Expand Down Expand Up @@ -700,8 +739,16 @@ static int forward_read_ack(struct flb_forward *ctx,
/* Lookup ack field */
for (i = 0; i < map.size; i++) {
key = map.ptr[i].key;
if (key.type != MSGPACK_OBJECT_STR) {
continue;
}

if (key.via.str.size == 3 && strncmp(key.via.str.ptr, "ack", 3) == 0) {
val = map.ptr[i].val;
if (val.type != MSGPACK_OBJECT_STR) {
goto error;
}

ack_len = val.via.str.size;
ack = val.via.str.ptr;
break;
Expand All @@ -715,15 +762,15 @@ static int forward_read_ack(struct flb_forward *ctx,

if (ack_len != chunk_len) {
flb_plg_error(ctx->ins,
"ack: ack len does not match ack(%ld)(%.*s) chunk(%d)(%.*s)",
"ack: ack len does not match ack(%zu)(%.*s) chunk(%d)(%.*s)",
ack_len, (int) ack_len, ack,
chunk_len, (int) chunk_len, chunk);
goto error;
}

if (strncmp(ack, chunk, ack_len) != 0) {
flb_plg_error(ctx->ins, "ACK: mismatch received=%s, expected=(%.*s)",
ack, chunk_len, chunk);
flb_plg_error(ctx->ins, "ACK: mismatch received=%.*s, expected=(%.*s)",
(int) ack_len, ack, chunk_len, chunk);
goto error;
}

Expand Down
Loading
Loading