From aa6c438ce8a1b1798235183266ee4b53184cd0ca Mon Sep 17 00:00:00 2001 From: arshiya tabasum Date: Mon, 13 Jul 2026 14:06:05 +0530 Subject: [PATCH 1/2] reject too-short PROXY v2 address length in mod_remoteip --- modules/metadata/mod_remoteip.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/modules/metadata/mod_remoteip.c b/modules/metadata/mod_remoteip.c index 27a42d3cd37..c99ef25da26 100644 --- a/modules/metadata/mod_remoteip.c +++ b/modules/metadata/mod_remoteip.c @@ -954,6 +954,13 @@ static remoteip_parse_status_t remoteip_process_v2_header(conn_rec *c, case 0x01: /* PROXY command */ switch (hdr->v2.fam) { case 0x11: /* TCPv4 */ + if (ntohs(hdr->v2.len) < sizeof(hdr->v2.addr.ip4)) { + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO() + "RemoteIPProxyProtocol: address length %hu " + "too short for TCPv4", + (unsigned short)ntohs(hdr->v2.len)); + return HDR_ERROR; + } ret = apr_sockaddr_info_get(&conn_conf->client_addr, NULL, APR_INET, ntohs(hdr->v2.addr.ip4.src_port), @@ -971,6 +978,13 @@ static remoteip_parse_status_t remoteip_process_v2_header(conn_rec *c, case 0x21: /* TCPv6 */ #if APR_HAVE_IPV6 + if (ntohs(hdr->v2.len) < sizeof(hdr->v2.addr.ip6)) { + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO() + "RemoteIPProxyProtocol: address length %hu " + "too short for TCPv6", + (unsigned short)ntohs(hdr->v2.len)); + return HDR_ERROR; + } ret = apr_sockaddr_info_get(&conn_conf->client_addr, NULL, APR_INET6, ntohs(hdr->v2.addr.ip6.src_port), From bfcf1788bd17d866bdd460cd5fb6d649f87a32a0 Mon Sep 17 00:00:00 2001 From: arshiya tabasum Date: Mon, 20 Jul 2026 15:33:14 +0530 Subject: [PATCH 2/2] mod_remoteip: use remoteip_get_v2_len for the v2 address length checks --- modules/metadata/mod_remoteip.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/modules/metadata/mod_remoteip.c b/modules/metadata/mod_remoteip.c index c99ef25da26..f365090ebf6 100644 --- a/modules/metadata/mod_remoteip.c +++ b/modules/metadata/mod_remoteip.c @@ -931,6 +931,12 @@ static int remoteip_hook_pre_connection(conn_rec *c, void *csd) return OK; } +/** Return length for a v2 protocol header. */ +static apr_size_t remoteip_get_v2_len(proxy_header *hdr) +{ + return ntohs(hdr->v2.len); +} + /* Binary format: * * sig = \x0D \x0A \x0D \x0A \x00 \x0D \x0A \x51 \x55 \x49 \x54 \x0A @@ -954,11 +960,11 @@ static remoteip_parse_status_t remoteip_process_v2_header(conn_rec *c, case 0x01: /* PROXY command */ switch (hdr->v2.fam) { case 0x11: /* TCPv4 */ - if (ntohs(hdr->v2.len) < sizeof(hdr->v2.addr.ip4)) { + if (remoteip_get_v2_len(hdr) < sizeof(hdr->v2.addr.ip4)) { ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO() - "RemoteIPProxyProtocol: address length %hu " - "too short for TCPv4", - (unsigned short)ntohs(hdr->v2.len)); + "RemoteIPProxyProtocol: address length " + "%" APR_SIZE_T_FMT " too short for TCPv4", + remoteip_get_v2_len(hdr)); return HDR_ERROR; } ret = apr_sockaddr_info_get(&conn_conf->client_addr, NULL, @@ -978,11 +984,11 @@ static remoteip_parse_status_t remoteip_process_v2_header(conn_rec *c, case 0x21: /* TCPv6 */ #if APR_HAVE_IPV6 - if (ntohs(hdr->v2.len) < sizeof(hdr->v2.addr.ip6)) { + if (remoteip_get_v2_len(hdr) < sizeof(hdr->v2.addr.ip6)) { ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO() - "RemoteIPProxyProtocol: address length %hu " - "too short for TCPv6", - (unsigned short)ntohs(hdr->v2.len)); + "RemoteIPProxyProtocol: address length " + "%" APR_SIZE_T_FMT " too short for TCPv6", + remoteip_get_v2_len(hdr)); return HDR_ERROR; } ret = apr_sockaddr_info_get(&conn_conf->client_addr, NULL, @@ -1031,12 +1037,6 @@ static remoteip_parse_status_t remoteip_process_v2_header(conn_rec *c, return HDR_DONE; } -/** Return length for a v2 protocol header. */ -static apr_size_t remoteip_get_v2_len(proxy_header *hdr) -{ - return ntohs(hdr->v2.len); -} - /** Determine if this is a v1 or v2 PROXY header. */ static int remoteip_determine_version(conn_rec *c, const char *ptr)