[jira] [Comment Edited] (TS-2825) Segmentation fault on POST request transformation

["portl4t (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/TS-2825?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14037003#comment-14037003 ] 

portl4t edited comment on TS-2825 at 6/19/14 6:08 AM:
------------------------------------------------------

I found that ATS does not support chunked post request transformation well, which has been described in HttpSM::state_request_wait_for_transform_read(...):
{code}
...
    } else {
      // No content length from the post.  This is a no go
      //  since http spec requires content length when
      //  sending a request message body.  Change the event
      //  to an error and fall through
      event = VC_EVENT_ERROR;
      Log::error("Request transformation failed to set content length");
    } 
    // FALLTHROUGH
  default:
    state_common_wait_for_transform_read(&post_transform_info, &HttpSM::tunnel_handler_post, event, data);
    break;
  }
{code}
As the VC_EVENT_ERROR event arise, the  tunnel will be killed, then the producer UA will invoke do_io_close which cause client_vc will be set to NULL, after that ATS will try to send error response to UA, so it will crash.

Should we just fix the crash or refine chunked post transformation?


was (Author: portl4t):
I found that ATS does not support chunked post request transformation well, which has been described in HttpSM::state_request_wait_for_transform_read(...):
...
 else {
      // No content length from the post.  This is a no go
      //  since http spec requires content length when
      //  sending a request message body.  Change the event
      //  to an error and fall through
      event = VC_EVENT_ERROR;
      Log::error("Request transformation failed to set content length");
    } 

As the VC_EVENT_ERROR event arise, the  tunnel will be killed, then the producer UA will invoke do_io_close which cause client_vc will be set to NULL, after that ATS will try to send error response to UA, so it will crash.

Should we just fix the crash or refine chunked post transformation?

> Segmentation fault on POST request transformation
> -------------------------------------------------
>
>                 Key: TS-2825
>                 URL: https://issues.apache.org/jira/browse/TS-2825
>             Project: Traffic Server
>          Issue Type: Bug
>          Components: Core, HTTP, Lua, Plugins, TS API
>            Reporter: Pasquale Puzio
>            Assignee: Kit Chan
>            Priority: Critical
>             Fix For: sometime
>
>
> I'm trying to write a simple encryption/decryption plugin for Apache Traffic Server. The plugin should transform requests/responses in order to encrypt/decrypt them. I decided to write the plugin in LUA (using the ts-lua plugin available here https://github.com/portl4t/ts-lua)
>     function encrypt(data, eos)
>     if (data == '') then
>         return data, eos
>     end
>     if (eos == 1) then
>         ts.debug('End of Stream')
>     end
>     return data, eos
>     end
>     function do_remap()
>     ts.debug('do_remap')
>     if (ts.client_request.get_method() == 'POST') then
>         ts.hook(TS_LUA_REQUEST_TRANSFORM, encrypt)
>     end
>     ts.http.resp_cache_transformed(0)
>     ts.http.resp_cache_untransformed(0)
>     return 0
>     end
> Everything works fine for GET and DELETE requests, but when I send a POST chunked-encoded request, ATS crashes almost every time.
> if I don't activate the request transformation hook, the chunked request is forwarded perfectly. Most of the time, if one request is forwarded succesfully, the one after crashes.
> Here is the stack trace:
> [May 20 13:16:28.105] Server {0x7f045a1c1700} DEBUG: (http_redirect) [HttpSM::do_redirect]
> [May 20 13:16:28.105] Server {0x7f045a1c1700} DEBUG: (http_redirect) [HttpTunnel::deallocate_postdata_copy_buffers]
> NOTE: Traffic Server received Sig 11: Segmentation fault
> bin/traffic_server - STACK TRACE: 
> /lib/x86_64-linux-gnu/libpthread.so.0(+0xfcb0)[0x7f045cd29cb0]
> bin/traffic_server(_ZN6HttpSM17handle_api_returnEv+0x171)[0x5c274f]
> bin/traffic_server(_ZN6HttpSM17state_api_calloutEiPv+0x883)[0x5c24cf]
> bin/traffic_server(_ZN6HttpSM23do_api_callout_internalEv+0x1b7)[0x5ceaef]
> bin/traffic_server(_ZN6HttpSM14do_api_calloutEv+0x26)[0x5dc18e]
> bin/traffic_server(_ZN6HttpSM14set_next_stateEv+0x12f9)[0x5d6a19]
> bin/traffic_server(_ZN6HttpSM32call_transact_and_set_next_stateEPFvPN12HttpTransact5StateEE+0x1ba)[0x5d5718]
> bin/traffic_server(_ZN6HttpSM36state_common_wait_for_transform_readEP17HttpTransformInfoMS_FiiPvEiS2_+0x39b)[0x5c1a11]
> bin/traffic_server(_ZN6HttpSM37state_request_wait_for_transform_readEiPv+0x1e1)[0x5c1483]
> bin/traffic_server(_ZN6HttpSM12main_handlerEiPv+0x333)[0x5c5eeb]
> bin/traffic_server(_ZN12Continuation11handleEventEiPv+0x68)[0x4f06b2]
> bin/traffic_server(_ZN17TransformTerminus12handle_eventEiPv+0x2f6)[0x538d2a]
> bin/traffic_server(_ZN12Continuation11handleEventEiPv+0x68)[0x4f06b2]
> bin/traffic_server(_ZN7EThread13process_eventEP5Eventi+0x11e)[0x7537e2]
> bin/traffic_server(_ZN7EThread7executeEv+0xc9)[0x753a27]
> bin/traffic_server[0x752ca7]
> /lib/x86_64-linux-gnu/libpthread.so.0(+0x7e9a)[0x7f045cd21e9a]
> /lib/x86_64-linux-gnu/libc.so.6(clone+0x6d)[0x7f045c0383fd]
> Segmentation fault (core dumped)
> I've already tried to use one of the example plugins for request transformation and I still have the same problem. The only way to make the problem disappear is to avoid request transformation.
> Is there something wrong in the way I'm transforming requests? What does this segmentation fault depend on?
> Thanks



--
This message was sent by Atlassian JIRA
(v6.2#6252)