Analyzing CVE-2024-34750 Apache Tomcat DoS

1
2
3
4
5
6
7
8

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
                     type="RSA" />
    </SSLHostConfig>
</Connector>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

public SocketState upgradeDispatch(SocketEvent status) {
    if (log.isTraceEnabled()) {
        log.trace(sm.getString("upgradeHandler.upgradeDispatch.entry", connectionId, status));
    }

    // WebConnection is not used so passing null here is fine
    // Might not be necessary. init() will handle that.
    init(null);

    SocketState result = SocketState.CLOSED;

    try {
        switch (status) {
            case OPEN_READ:
                socketWrapper.getLock().lock();
                try {
                    if (socketWrapper.canWrite()) {
                        // Only send a ping if there is no other data waiting to be sent.
                        // Ping manager will ensure they aren't sent too frequently.
                        pingManager.sendPing(false);
                    }
                } finally {
                    socketWrapper.getLock().unlock();
                }
                try {
                    // Disable the connection timeout while frames are processed
                    setConnectionTimeout(-1);
                    while (true) {
                        try {
                            if (!parser.readFrame()) {
                                break;
                            }
                        } catch (StreamException se) {
                            // Log the Stream error but not necessarily all of
                            // them
                            UserDataHelper.Mode logMode = userDataHelper.getNextMode();
                            if (logMode != null) {
                                String message = sm.getString("upgradeHandler.stream.error", connectionId,
                                        Integer.toString(se.getStreamId()));
                                switch (logMode) {
                                    case INFO_THEN_DEBUG:
                                        message += sm.getString("upgradeHandler.fallToDebug");
                                        //$FALL-THROUGH$
                                    case INFO:
                                        log.info(message, se);
                                        break;
                                    case DEBUG:
                                        log.debug(message, se);
                                }
                            }
                            // Stream errors are not fatal to the connection so
                            // continue reading frames
                            Stream stream = getStream(se.getStreamId(), false);
                            if (stream == null) {
                                sendStreamReset(null, se);
                            } else {
                                stream.close(se);
                            }
                        } finally {
                            if (isOverheadLimitExceeded()) {
                                throw new ConnectionException(
                                        sm.getString("upgradeHandler.tooMuchOverhead", connectionId),
                                        Http2Error.ENHANCE_YOUR_CALM);
                            }
                        }
                    }

                    // Need to know the correct timeout before starting the read
                    // but that may not be known at this time if one or more
                    // requests are currently being processed so don't set a
                    // timeout for the socket...
                    socketWrapper.setReadTimeout(-1);

                    // ...set a timeout on the connection
                    setConnectionTimeoutForStreamCount(activeRemoteStreamCount.get());

// .....truncated
    return result;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

protected void setConnectionTimeoutForStreamCount(int streamCount) {
    if (streamCount == 0) {
        // No streams currently active. Use the keep-alive
        // timeout for the connection.
        long keepAliveTimeout = protocol.getKeepAliveTimeout();
        if (keepAliveTimeout == -1) {
            setConnectionTimeout(-1);
        } else {
            setConnectionTimeout(System.currentTimeMillis() + keepAliveTimeout);
        }
    } else {
        // Streams currently active. Individual streams have
        // timeouts so keep the connection open.
        setConnectionTimeout(-1);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

protected void readHeadersFrame(int streamId, int flags, int payloadSize, ByteBuffer buffer)
        throws Http2Exception, IOException {

    headersEndStream = Flags.isEndOfStream(flags);

    if (hpackDecoder == null) {
        hpackDecoder = output.getHpackDecoder();
    }
    try {
        hpackDecoder.setHeaderEmitter(output.headersStart(streamId, headersEndStream));
    } catch (StreamException se) {
        swallowPayload(streamId, FrameType.HEADERS.getId(), payloadSize, false, buffer);
        throw se;
    }
    
    // .. truncated
    
    readHeaderPayload(streamId, payloadSize, buffer);

    swallowPayload(streamId, FrameType.HEADERS.getId(), padLength, true, buffer);

    // Validate the headers so far
    hpackDecoder.getHeaderEmitter().validateHeaders();

    if (Flags.isEndOfHeaders(flags)) {
        onHeadersComplete(streamId);
    } else {
        headersCurrentStream = streamId;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

public void headersEnd(int streamId, boolean endOfStream) throws Http2Exception {
    AbstractNonZeroStream abstractNonZeroStream =
            getAbstractNonZeroStream(streamId, connectionState.get().isNewStreamAllowed());
    if (abstractNonZeroStream instanceof Stream) {
        boolean processStream = false;
        setMaxProcessedStream(streamId);
        Stream stream = (Stream) abstractNonZeroStream;
        if (stream.isActive()) {
            if (stream.receivedEndOfHeaders()) {

                if (localSettings.getMaxConcurrentStreams() < activeRemoteStreamCount.incrementAndGet()) {
                    decrementActiveRemoteStreamCount();
                    // Ignoring maxConcurrentStreams increases the overhead count
                    increaseOverheadCount(FrameType.HEADERS);
                    throw new StreamException(
                            sm.getString("upgradeHandler.tooManyRemoteStreams",
                                    Long.toString(localSettings.getMaxConcurrentStreams())),
                            Http2Error.REFUSED_STREAM, streamId);
                }
                // Valid new stream reduces the overhead count
                reduceOverheadCount(FrameType.HEADERS);

                processStream = true;
            }
        }

1
2
3
4
5
6

protected void sentEndOfStream(Stream stream) {
    stream.sentEndOfStream();
    if (!stream.isActive()) {
        decrementActiveRemoteStreamCount();
    }
}

1
2
3

protected void decrementActiveRemoteStreamCount() {
    setConnectionTimeoutForStreamCount(activeRemoteStreamCount.decrementAndGet());
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

protected void readHeaderPayload(int streamId, int payloadSize, ByteBuffer buffer)
        throws Http2Exception, IOException {

    // ... truncated

        if (hpackDecoder.isHeaderSizeExceeded(headerReadBuffer.position())) {
            StreamException headerException = new StreamException(
                    sm.getString("http2Parser.headerLimitSize", connectionId, Integer.valueOf(streamId)),
                    Http2Error.ENHANCE_YOUR_CALM, streamId);
            hpackDecoder.getHeaderEmitter().setHeaderException(headerException);
        }

        if (hpackDecoder.isHeaderSwallowSizeExceeded(headerReadBuffer.position())) {
            throw new ConnectionException(
                    sm.getString("http2Parser.headerLimitSize", connectionId, Integer.valueOf(streamId)),
                    Http2Error.ENHANCE_YOUR_CALM);
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

final void close(Http2Exception http2Exception) {
    if (http2Exception instanceof StreamException) {
        try {
            StreamException se = (StreamException) http2Exception;
            if (log.isTraceEnabled()) {
                log.trace(sm.getString("stream.reset.send", getConnectionId(), getIdAsString(), se.getError()));
            }

            handler.sendStreamReset(state, se);

            cancelAllocationRequests();
            if (inputBuffer != null) {
                inputBuffer.swallowUnread();
            }
        } catch (IOException ioe) {
            ConnectionException ce =
                    new ConnectionException(sm.getString("stream.reset.fail", getConnectionId(), getIdAsString()),
                            Http2Error.PROTOCOL_ERROR, ioe);
            handler.closeConnection(ce);
        }
    } else {
        handler.closeConnection(http2Exception);
    }
    recycle();
}