Summary
When an upstream TLS cluster is used with auto_sni enabled, a request containing a host/:authority (or alternate header configured via override_auto_sni_header ) header longer than 255 characters triggers an abnormal termination of Envoy process.
Affected Components
TLS component for outbound connections.
Details
Envoy does not gracefully handle an error when setting SNI for outbound TLS connection. The error can occur when Envoy attempts to use the host/:authority header value longer than 255 characters as SNI for outbound TLS connection. SNI length is limited to 255 characters per the standard. Envoy always expects this operation to succeed and abnormally aborts the process when it fails.
Impact
Denial of Service due to abnormal process termination.
Attack vector(s)
A client request with host/:authority header (or alternate header configured via override_auto_sni_header ) longer than 255 characters that is proxied to Envoy cluster with auto_sni option set to true.
Patches
This bug affects all currently maintained versions (and all versions from 1.13 to 1.30): 1.27.x, 1.28.x, 1.29.x, 1.30.x.
This bug is fixed in our latest versions. Update to the following versions to resolve:
- >=1.30.1
- >=1.29.4
- >=1.28.3
- >=1.27.5
Workarounds
Possible ways to prevent the crash:
- Use Lua or Wasm filter to validate the host before sending it to upstream. This should work for all versions that are effected by this bug. See https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/lua_filter
- Drop the requests with
host/:authority longer than 255 characters (i.e. using regular expression matcher) by setting route match rules (to send local reply). You should make the special route first in the route table to ensure all problematic requests are caught.
- Drop the requests with
host/:authority values longer than 255 bytes with a custom HTTP filter.
- Rewrite the
host/:authority to a trusted value shorter than 255 characters with request_headers_to_add, host_rewrite_specifier, or a custom HTTP filter.
- Set the
auto_sni option to false.
Detection
Abnormal process termination with the assert failure: rc. Details: error:100000d5:SSL routines:OPENSSL_internal:SSL3_EXT_INVALID_SERVERNAME message in the error log.
Credits
Adiyamankottai Rajaram, Archana Archana.Rajaram@netscout.com
Summary
When an upstream TLS cluster is used with
auto_snienabled, a request containing ahost/:authority(or alternate header configured viaoverride_auto_sni_header) header longer than 255 characters triggers an abnormal termination of Envoy process.Affected Components
TLS component for outbound connections.
Details
Envoy does not gracefully handle an error when setting SNI for outbound TLS connection. The error can occur when Envoy attempts to use the
host/:authorityheader value longer than 255 characters as SNI for outbound TLS connection. SNI length is limited to 255 characters per the standard. Envoy always expects this operation to succeed and abnormally aborts the process when it fails.Impact
Denial of Service due to abnormal process termination.
Attack vector(s)
A client request with
host/:authorityheader (or alternate header configured viaoverride_auto_sni_header) longer than 255 characters that is proxied to Envoy cluster withauto_snioption set to true.Patches
This bug affects all currently maintained versions (and all versions from 1.13 to 1.30): 1.27.x, 1.28.x, 1.29.x, 1.30.x.
This bug is fixed in our latest versions. Update to the following versions to resolve:
Workarounds
Possible ways to prevent the crash:
host/:authoritylonger than 255 characters (i.e. using regular expression matcher) by setting route match rules (to send local reply). You should make the special route first in the route table to ensure all problematic requests are caught.host/:authorityvalues longer than 255 bytes with a custom HTTP filter.host/:authorityto a trusted value shorter than 255 characters withrequest_headers_to_add,host_rewrite_specifier, or a custom HTTP filter.auto_snioption tofalse.Detection
Abnormal process termination with the
assert failure: rc. Details: error:100000d5:SSL routines:OPENSSL_internal:SSL3_EXT_INVALID_SERVERNAMEmessage in the error log.Credits
Adiyamankottai Rajaram, Archana Archana.Rajaram@netscout.com