Skip to content

Fix set-status crash inside if/endif at remap time#13052

Merged
moonchen merged 1 commit into
apache:masterfrom
moonchen:worktree-master-set-status-fix
Jun 23, 2026
Merged

Fix set-status crash inside if/endif at remap time#13052
moonchen merged 1 commit into
apache:masterfrom
moonchen:worktree-master-set-status-fix

Conversation

@moonchen

@moonchen moonchen commented Apr 2, 2026

Copy link
Copy Markdown
Contributor

Operators inside an if/endif block never had set_hook() called on them, so _hook retained its default value of TS_HTTP_READ_RESPONSE_HDR_HOOK. When set-status executed at REMAP_PSEUDO_HOOK time, exec() took the response-hook branch and called TSHttpHdrStatusSet on a request buffer, corrupting the header union and crashing.

Fix the operator to check TSHttpHdrTypeGet() at runtime instead of trusting get_hook(). Removed _hook and get_hook() from operators.

set_hook() becomes is_hook_valid() in Statement and RuleSet to only validate hook compatibility without mutating _hook.

Upgrade the HTTPHdr::status_set/reason_set asserts to release_assert so that writing response fields into a request buffer is caught immediately rather than silently corrupting memory.

Includes an autest that reproduces the crash scenario: set-status 403 inside an if/endif block under REMAP_PSEUDO_HOOK.

@moonchen moonchen requested a review from zwoop April 2, 2026 18:41
@moonchen moonchen self-assigned this Apr 2, 2026
@moonchen moonchen added Plugins header_rewrite header_rewrite plugin Bug and removed Plugins header_rewrite header_rewrite plugin labels Apr 2, 2026
@moonchen moonchen added this to the 11.0.0 milestone Apr 2, 2026
@moonchen moonchen force-pushed the worktree-master-set-status-fix branch from f480c1b to 7cff341 Compare April 2, 2026 18:46
@moonchen moonchen marked this pull request as draft April 2, 2026 18:46
@zwoop

zwoop commented Apr 15, 2026

Copy link
Copy Markdown
Contributor

Does this still need to be marked as a Draft ?

@moonchen moonchen marked this pull request as ready for review June 1, 2026 19:34
Copilot AI review requested due to automatic review settings June 1, 2026 19:34

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes a crash in the header_rewrite plugin when set-status is used inside an if/endif block during REMAP_PSEUDO_HOOK execution by avoiding hook-based assumptions and instead checking the actual header type at runtime. This also hardens core HTTP header manipulation by turning response-polarity debug asserts into release asserts to prevent silent memory corruption.

Changes:

  • Update set-status execution logic to branch based on TSHttpHdrTypeGet() rather than a stored hook value.
  • Replace Statement::set_hook() with a non-mutating Statement::is_hook_valid() for hook compatibility checks during config parsing.
  • Add a gold test reproducing the remap-time nested if/endif set-status crash and validating a 403 proxy response.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Show a summary per file
File Description
tests/gold_tests/pluginTest/header_rewrite/rules/set_status_in_if.conf Adds minimal header_rewrite rules reproducing nested if/endif set-status at remap time.
tests/gold_tests/pluginTest/header_rewrite/header_rewrite_bundle.replay.yaml Adds a remap mapping and a replay session asserting set-status yields 403 without crashing.
src/proxy/hdrs/HTTP.cc Promotes response-polarity asserts for status/reason setters to ink_release_assert.
include/proxy/hdrs/HTTP.h Promotes response-polarity asserts for HTTPHdr::status_set/reason_set to ink_release_assert.
plugins/header_rewrite/statement.h Removes stored hook state from Statement; introduces is_hook_valid() API.
plugins/header_rewrite/statement.cc Implements is_hook_valid() as a pure validation check (no mutation).
plugins/header_rewrite/ruleset.cc Uses is_hook_valid() when validating operator/condition compatibility with the rule hook.
plugins/header_rewrite/operators.cc Fixes OperatorSetStatus::exec() to detect response vs request by header type; adjusts redirect debug logging to not reference removed hook state.

Operators inside an if/endif block never had set_hook() called on them,
so _hook retained its default value of TS_HTTP_READ_RESPONSE_HDR_HOOK.
When set-status executed at REMAP_PSEUDO_HOOK time, exec() took the
response-hook branch and called TSHttpHdrStatusSet on a request buffer,
corrupting the header union and crashing.

Fix the operator to check TSHttpHdrTypeGet() at runtime instead of
trusting get_hook().  Removed _hook and get_hook() from operators.

set_hook() becomes is_hook_valid() in Statement and RuleSet to
only validate hook compatibility without mutating _hook.

Upgrade the HTTPHdr::status_set/reason_set asserts to release_assert so
that writing response fields into a request buffer is caught immediately
rather than silently corrupting memory.

Includes an autest that reproduces the crash scenario: set-status 403
inside an if/endif block under REMAP_PSEUDO_HOOK.
@moonchen moonchen force-pushed the worktree-master-set-status-fix branch from 7cff341 to e4728cc Compare June 20, 2026 23:47
@moonchen

Copy link
Copy Markdown
Contributor Author

@zwoop ready for review when you have a chance

@zwoop zwoop left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good.

@moonchen moonchen merged commit bdb24cf into apache:master Jun 23, 2026
15 checks passed
@github-project-automation github-project-automation Bot moved this to For v10.2.0 in ATS v10.2.x Jun 23, 2026
@cmcfarlen cmcfarlen moved this from For v10.2.0 to Picked v10.2.0 in ATS v10.2.x Jun 25, 2026
@cmcfarlen cmcfarlen modified the milestones: 11.0.0, 10.2.0 Jun 25, 2026
@cmcfarlen

Copy link
Copy Markdown
Contributor

Cherry-picked to 10.2.x

cmcfarlen pushed a commit that referenced this pull request Jun 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Bug header_rewrite header_rewrite plugin Plugins

Projects

Status: For v10.1.1
Status: Picked v10.2.0

Development

Successfully merging this pull request may close these issues.

4 participants