You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2008/04/14 08:50:52 UTC
DO NOT REPLY [Bug 44818] New: tomcat hangs with GET when
content-length is defiend
https://issues.apache.org/bugzilla/show_bug.cgi?id=44818
Summary: tomcat hangs with GET when content-length is defiend
Product: Tomcat 6
Version: 6.0.16
Platform: All
OS/Version: All
Status: NEW
Severity: normal
Priority: P2
Component: Connectors
AssignedTo: tomcat-dev@jakarta.apache.org
ReportedBy: etouchard@infovista.com
When a request with GET method is done with a content-length header set to for
example 10000, the thread serving the request hangs until time out.
it hangs due to a call to IdentityInputFilter.end();
Could it be a security problem (dos attack) ?
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 44818] tomcat hangs with GET when content-length is defined
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44818
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |WONTFIX
--- Comment #6 from Mark Thomas <ma...@apache.org> ---
The only way to handle this would be to explicitly deny GET requests with a
content length header and close the connection with a 400 response.
If an application wants to do this, they can do so with a Filter.
There is no greater DoS risk with this than there is with a POST request that
fails to provide the complete request body.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 44818] tomcat hangs with GET when content-length
is defined
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44818
--- Comment #4 from Touchard <et...@infovista.com> 2008-04-15 00:23:55 PST ---
I've check the rfc 2616 and i found the following
The presence of a message-body in a request is signaled by the inclusion of a
Content-Length or Transfer-Encoding header field in the request's
message-headers. A message-body MUST NOT be included in a request if the
specification of the request method (section 5.1.1) does not allow sending an
entity-body in requests. A server SHOULD read and forward a message-body on any
request; if the request method does not include defined semantics for an
entity-body, then the message-body SHOULD be ignored when handling the request.
And of course there is no mention of "GET method does not allow sending an
entity-body", so i guess it's allowed, stange but allowed.
And it is specified that "A server SHOULD read and forward a message-body on
any request", so you have to swallow extra information.
By telling "it only uses a thread", do you mean only one thread for the whole
tomcat, or one thread by request ?
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 44818] tomcat hangs with GET when content-length
is defined
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44818
--- Comment #3 from Remy Maucherat <re...@apache.org> 2008-04-14 09:57:12 PST ---
A GET with a body is perfectly valid. An option would allow disabling data
swallowing, for all methods (if data remains after the execution of the
servlet, the connection would then be closed).
Note: this is not a security problem (it only uses a thread, as many
operations).
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 44818] tomcat hangs with GET when content-length
is defiend
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44818
--- Comment #1 from Remy Maucherat <re...@apache.org> 2008-04-14 07:52:43 PST ---
I would be ok to add an option for that. Not reading would mean no keepalive
when there's leftover data.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 44818] tomcat hangs with GET when content-length
is defined
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44818
Touchard <et...@infovista.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|tomcat hangs with GET when |tomcat hangs with GET when
|content-length is defiend |content-length is defined
--- Comment #2 from Touchard <et...@infovista.com> 2008-04-14 08:25:23 PST ---
I like your suggestion about an option. And you are right, not reading would
mean no keepalive, but asking a GET with a content-length is either a
programmer mistake or a malicious act. It should not appear on production
server. I think that in this particular case the keepalive can be broke.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 44818] tomcat hangs with GET when content-length
is defined
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44818
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Severity|normal |enhancement
--- Comment #5 from Mark Thomas <ma...@apache.org> 2008-04-17 12:08:54 PST ---
It is one thread per request and it is up to the app to read the content. As
Remy said, an option could be added to do this by default.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org