svn commit: r1878280 - in /httpd/httpd/trunk: CHANGES modules/proxy/mod_proxy_http.c

[yl...@apache.org]

Author: ylavic
Date: Fri May 29 17:05:29 2020
New Revision: 1878280

URL: http://svn.apache.org/viewvc?rev=1878280&view=rev
Log:
mod_proxy_http: don't strip EOS when spooling request body to file.

To prevent stream_reqbody() from sending the FILE and EOS bucket in separate
brigades, and thus apr_file_setaside() to trigger if network congestion occurs
with the backend, restore the EOS in spool_reqbody_cl() which was stripped
when spooling the request body to a file.

Until APR r1878279 is released (and installed by users), apr_file_setaside()
on a temporary file (mktemp) will simply drop the file cleanup, leaking the
fd and inode..

This fixes BZ 64452.

Modified:
    httpd/httpd/trunk/CHANGES
    httpd/httpd/trunk/modules/proxy/mod_proxy_http.c

Modified: httpd/httpd/trunk/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?rev=1878280&r1=1878279&r2=1878280&view=diff
==============================================================================
--- httpd/httpd/trunk/CHANGES [utf-8] (original)
+++ httpd/httpd/trunk/CHANGES [utf-8] Fri May 29 17:05:29 2020
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.1
 
+  *) mod_proxy_http: flush spooled request body in one go to avoid
+     leaking (or long lived) temporary file. PR 64452. [Yann Ylavic]
+
   *) mod_proxy_http2: respect ProxyTimeout settings on backend connections
      while waiting on incoming data. [Ruediger Pluem, Stefan Eissing]
 

Modified: httpd/httpd/trunk/modules/proxy/mod_proxy_http.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?rev=1878280&r1=1878279&r2=1878280&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/proxy/mod_proxy_http.c (original)
+++ httpd/httpd/trunk/modules/proxy/mod_proxy_http.c Fri May 29 17:05:29 2020
@@ -549,6 +549,14 @@ static int spool_reqbody_cl(proxy_http_r
         e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc);
         APR_BRIGADE_INSERT_TAIL(input_brigade, e);
     }
+    if (tmpfile) {
+        /* We dropped metadata buckets when spooling to tmpfile,
+         * terminate with EOS for stream_reqbody() to flush the
+         * whole in one go.
+         */
+        e = apr_bucket_eos_create(bucket_alloc);
+        APR_BRIGADE_INSERT_TAIL(input_brigade, e);
+    }
     return OK;
 }
 

Re: svn commit: r1878280 - in /httpd/httpd/trunk: CHANGES modules/proxy/mod_proxy_http.c

[Ruediger Pluem <rp...@apache.org>]

On 5/29/20 7:05 PM, ylavic@apache.org wrote:
> Author: ylavic
> Date: Fri May 29 17:05:29 2020
> New Revision: 1878280
> 
> URL: http://svn.apache.org/viewvc?rev=1878280&view=rev
> Log:
> mod_proxy_http: don't strip EOS when spooling request body to file.
> 
> To prevent stream_reqbody() from sending the FILE and EOS bucket in separate
> brigades, and thus apr_file_setaside() to trigger if network congestion occurs
> with the backend, restore the EOS in spool_reqbody_cl() which was stripped
> when spooling the request body to a file.
> 
> Until APR r1878279 is released (and installed by users), apr_file_setaside()
> on a temporary file (mktemp) will simply drop the file cleanup, leaking the
> fd and inode..
> 
> This fixes BZ 64452.

This was a really tricky and nasty one. Excellent debug job. Plus it brought us nice improvements to .gdbinit :-)

Regards

Rüdiger