Bug #2105

TCP packet bisection causes dead requests

Added by zetzet about 5 years ago. Updated almost 5 years ago.

Status:FixedStart date:2009-11-24
Priority:NormalDue date:
Assignee:-% Done:

100%

Category:core
Target version:1.4.26
Missing in 1.5.x:No

Description

We are experiencing a weird problem here with Lighttpd.

Phenomenom:
A client sends a valid HTTP request. The request arrives at the server (according to wireshark) but even though Lighttpd is processing the header (according to debug logs), the request is never answered. No further data is loaded from HD, no PHP
script is being called. The request does also not appear in the logs at all (unlike other requests).

Reproduceability:
Difficult. We have users complaining about not working services that we provide but we had a hard time to reproduce the bug.
I finally found a netbook (Asus eee) that is running XP and has an IE 6 installation. The weird thing is: The request's success depends on the fact if the netbook has a power supply or not. If I pull out the power supply, the request is not being answered.
If the device is plugged in, the request gets answered. The only difference I can think of here is a different TCP packet slicing due to different timing of CPU / chips etc. The request data is looking exactly the same in both cases.
Also, the problem can not be reproduced if keep-alive is switched off. And if the order of data requests is being changed (different forder of downloaded images etc.), the request either fails or is successful. Therefore I am unable to provide a simple testcase.

Suspicion:
I have been able to reproduce the same behavior using a simple script. Lighttpd requires the HTTP client to send \r\n as line ends or the header to be parsed - just using \n is not working. However, if the \r and the \n is put into different TCP packets, Lighttpd is then unable to recognize it as successful request, therefore, a request that looks like that fails if the final \r\n is delivered in different packets:

Sending header:
POST / HTTP/1.1\r\n
Host: tw1.local\r\n
Content-Length: 0\r\n
Connection: close\r\n
\r\n

send> POST / HTTP/1.1\r\n
send> Host: tw1.local\r\n
send> Content-Length: 0\r\n
send> Connection: close\r\n
send> \r
send> \n

timeout

I do not know however if our problem could be resolved if this problem would be fixed. Other webservers are able to handle such "evil" requests correctly. Only Lighttpd seems to be having problems with that.

(* it doesn't matter if it's a post or a get request)

Associated revisions

Revision 2696
Added by stbuehler almost 5 years ago

Fix request parser to handle packets with splitted \r\n\r\n (fixes #2105)

History

#1 Updated by stbuehler about 5 years ago

Yes, you are right - the request parser fails if the terminating "\r\n\r\n" is splitted over more than 2 chunks.
I'm trying to fix it, http://cgit.lighttpd.net/lighttpd/lighttpd-1.x/commit/?h=lighttpd-1.4.x-stbuehler is my current version.

#2 Updated by stbuehler almost 5 years ago

  • Target version changed from 1.4.x to 1.4.26

#3 Updated by stbuehler almost 5 years ago

  • Status changed from New to Fixed
  • % Done changed from 0 to 100

Applied in changeset r2696.

Also available in: Atom