Skip to content

Conversation

@bryancall
Copy link
Contributor

@bryancall bryancall commented Dec 19, 2025

Summary

When a plugin or internal code modifies the Host header via MIME layer functions (e.g., mime_field_value_set), the HTTPHdr cached host info becomes stale. The cached m_host_length doesn't match the new value, causing host_get() to return incorrect data with garbage characters appended.

Symptom: SNI warnings in diags.log showing garbage characters appended to hostnames:

WARNING: SNI (example.com^R) not in certificate
WARNING: SNI (example.compYpeZhV) not in certificate

Root Cause

HTTPHdr caches host info in _fill_target_cache() but MIME layer modifications bypass HTTPHdr, leaving m_target_cached true with stale m_host_length.

Fix

Detect staleness by caching both the host value pointer and raw length. On access, compare current MIMEField values against cached values. If either differs, the value was modified and we refill the cache.

This approach:

  • Keeps cache logic entirely within HTTPHdr (clean separation)
  • Doesn't modify MIMEHdrImpl (safe for disk cache format)
  • Detects all modification paths including plugin API calls

Testing

Added comprehensive unit tests covering host header modifications with various scenarios including port handling (47 assertions).

When a plugin or internal code modifies the Host header via MIME layer
functions (e.g., mime_field_value_set), the HTTPHdr cached host info
becomes stale. The cached m_host_length doesn't match the new value,
causing host_get() to return incorrect data with garbage characters
appended (e.g., SNI warnings showing 'mysterio.yahoo.com^R').

Root cause: HTTPHdr caches host info in _fill_target_cache() but the
MIME layer modifications bypass HTTPHdr, leaving m_target_cached true
with stale m_host_length.

Fix: Detect staleness by caching both the host value pointer and raw
length. On access, compare current MIMEField values against cached
values. If either differs, the value was modified and we refill the
cache. This approach:
- Keeps cache logic entirely within HTTPHdr (clean separation)
- Doesn't modify MIMEHdrImpl (safe for disk cache format)
- Detects all modification paths including plugin API calls

Added comprehensive unit tests covering host header modifications
with various scenarios including port handling.
@bryancall bryancall added this to the 10.2.0 milestone Dec 19, 2025
@bryancall bryancall self-assigned this Dec 19, 2025
@bryancall bryancall requested a review from bneradt December 20, 2025 03:01
Copy link
Contributor

@bneradt bneradt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Putting this down on a production box, I notice that this seems to cause cache inconsistency issues somehow:

[Dec 24 00:39:43.839] [ET_NET 21] NOTE: OpenReadHead failed for cachekey 8DAE679C : vector inconsistency - unmarshalled -1 expecting 9312 in 27488 (base=72, ver=24:2) - vector n=0 size=0first alt=-1412571411[alive]
[Dec 24 00:40:01.587] [ET_NET 11] NOTE: OpenReadHead failed for cachekey 29AE3301 : vector inconsistency - unmarshalled -1 expecting 34048 in 63287 (base=72, ver=24:2) - vector n=0 size=0first alt=-1412571411[alive]
[Dec 24 00:41:05.038] [ET_NET 13] NOTE: OpenReadHead failed for cachekey 79D8D5F3 : vector inconsistency - unmarshalled -1 expecting 7560 in 7643 (base=72, ver=24:2) - vector n=0 size=0first alt=-1412571411[alive]
[Dec 24 00:41:48.622] [ET_NET 43] NOTE: OpenReadHead failed for cachekey A2EBB073 : vector inconsistency - unmarshalled -1 expecting 612824 in 612900 (base=72, ver=24:2) - vector n=0 size=0first alt=-1412571411[alive]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants