rc-httpd bug

rc-httpd bug

[BurnZeZ]

lachs0r pointed out a bug involving the request handling.
When someone makes a request, rc-httpd does not limit the size of the request.
It loops getting lines until the request is complete, or rc runs out of memory.

fn getline{ read | sed 's/'^$"cr^'$//g' }

done=false
while(~ $"done false){
	line=`{getline}
	if(~ $#line 0)
		done=true
	reqlines=$"reqlines$"line'
'

The preceding excerpts should make the problem apparent.
See /rc/bin/rc-httpd/rc-httpd:/^done/

Another thing of note is that read(1) as used here will read until newline
with no regard for how much data is read.

RFC2616 section 10.4.14 speaks of a response, 413 Request Entity Too Large

>   The server is refusing to process a request because the request
>   entity is larger than the server is willing or able to process. The
>   server MAY close the connection to prevent the client from continuing
>   the request.
>
>   If the condition is temporary, the server SHOULD include a Retry-
>   After header field to indicate that it is temporary and after what
>   time the client MAY try again.

This definition leaves it up to the server to decide how much crap it tolerates.
From a quick glance at a few http server implementations, I see limits varying from 1-48 KB.
I'm not familiar enough with http to know how to impose such a limitation without
breaking things.

Re: [9front] rc-httpd bug

[Kurt H Maier]

tell lachs0r if he wants nginx he knows where to find it

khm

Re: [9front] rc-httpd bug

[BurnZeZ]

> tell lachs0r if he wants nginx he knows where to find it
Regardless of what lachs0r says, it's probably not the best idea to let
your system be run out of memory serving http.

Re: [9front] rc-httpd bug

[Kurt H Maier]

Quoting BurnZeZ@feline.systems:

> Regardless of what lachs0r says, it's probably not the best idea to let
> your system be run out of memory serving http.

It's not even a good idea to serve http in the first place.  It's amazing
eekee was able to even produce a working httpd in shell; getting fiddly with
tyring to harden a daemon which is obviously not intended to base your
business around is probably a waste of time.

Resource exhaustion problems are not easily fixed; see the recent 9fans
thread on the topic.  In this case it would be simplest to write a small
utility to handle the ingest and drop the read operation after n bytes.

Patches welcome.

khm