httpd sends too many 408s

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

httpd sends too many 408s

Ted Unangst-6
HTTP/1.1 connections stay alive by default, unless the client or server
indicates it will close with the Connection: close header. After a timeout,
the connection typically closes anyway.

httpd in this case sends back a 408 Request Timeout response. This is unusual.

I did not exhaustively study the RFCs, but 408 seems primarily for indicating
that the client is sending the request too slowly. If the server has already
finished the request, then 408 would not apply.

Other servers don't seem to send 408 either. When they have decided that a
keepalive connection is too old, they simply close it.

In my case, I'm not running httpd server, but the go http client complains
about receiving unexpected data.

Reply | Threaded
Open this post in threaded view
|

Re: httpd sends too many 408s

Sebastian Benoit-3
see

https://marc.info/?t=152088166500003&r=1&w=2

Unfortunatly the diff i came up with is wrong (attached again i case it
helps someone).

I had to back it out again:

https://marc.info/?t=153920273300001&r=1&w=2



Ted Unangst([hidden email]) on 2019.01.01 22:06:05 -0500:

> HTTP/1.1 connections stay alive by default, unless the client or server
> indicates it will close with the Connection: close header. After a timeout,
> the connection typically closes anyway.
>
> httpd in this case sends back a 408 Request Timeout response. This is unusual.
>
> I did not exhaustively study the RFCs, but 408 seems primarily for indicating
> that the client is sending the request too slowly. If the server has already
> finished the request, then 408 would not apply.
>
> Other servers don't seem to send 408 either. When they have decided that a
> keepalive connection is too old, they simply close it.
>
> In my case, I'm not running httpd server, but the go http client complains
> about receiving unexpected data.
>


Author: benno <benno>
Date:   Mon Oct 1 19:24:10 2018 +0000

    Only send 408 Timeout responses when we have seen at least part of a
    request.  Without a request, just close the connection when we hit
    request timeout.
    Prompted by a bug report from Nikola Kolev, thanks.
    ok reyk@ and some suggestions from claudio@ and bluhm@

diff --git usr.sbin/httpd/httpd.h usr.sbin/httpd/httpd.h
index 4b1d9d72237..67cb45e138d 100644
--- usr.sbin/httpd/httpd.h
+++ usr.sbin/httpd/httpd.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: httpd.h,v 1.140 2018/09/09 21:06:51 bluhm Exp $ */
+/* $OpenBSD: httpd.h,v 1.141 2018/10/01 19:24:09 benno Exp $ */
 
 /*
  * Copyright (c) 2006 - 2015 Reyk Floeter <[hidden email]>
@@ -100,10 +100,11 @@
 
 enum httpchunk {
  TOREAD_UNLIMITED = -1,
- TOREAD_HTTP_HEADER = -2,
- TOREAD_HTTP_CHUNK_LENGTH = -3,
- TOREAD_HTTP_CHUNK_TRAILER = -4,
- TOREAD_HTTP_NONE = -5,
+ TOREAD_HTTP_INIT = -2,
+ TOREAD_HTTP_HEADER = -3,
+ TOREAD_HTTP_CHUNK_LENGTH = -4,
+ TOREAD_HTTP_CHUNK_TRAILER = -5,
+ TOREAD_HTTP_NONE = -6,
  TOREAD_HTTP_RANGE = TOREAD_HTTP_CHUNK_LENGTH
 };
 
diff --git usr.sbin/httpd/server.c usr.sbin/httpd/server.c
index 5f4304705d8..ef4aa6a2a93 100644
--- usr.sbin/httpd/server.c
+++ usr.sbin/httpd/server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: server.c,v 1.114 2018/05/19 13:56:56 jsing Exp $ */
+/* $OpenBSD: server.c,v 1.115 2018/10/01 19:24:09 benno Exp $ */
 
 /*
  * Copyright (c) 2006 - 2015 Reyk Floeter <[hidden email]>
@@ -901,7 +901,6 @@ server_input(struct client *clt)
  return;
  }
 
- clt->clt_toread = TOREAD_HTTP_HEADER;
  inrd = server_read_http;
 
  slen = sizeof(clt->clt_sndbufsiz);
@@ -1019,7 +1018,10 @@ server_error(struct bufferevent *bev, short error, void *arg)
  struct evbuffer *dst;
 
  if (error & EVBUFFER_TIMEOUT) {
- server_abort_http(clt, 408, "timeout");
+ if (clt->clt_toread != TOREAD_HTTP_INIT)
+ server_abort_http(clt, 408, "timeout");
+ else
+ server_abort_http(clt, 0, "timeout");
  return;
  }
  if (error & EVBUFFER_ERROR) {
diff --git usr.sbin/httpd/server_http.c usr.sbin/httpd/server_http.c
index 9306082edaf..c61e4128bf1 100644
--- usr.sbin/httpd/server_http.c
+++ usr.sbin/httpd/server_http.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: server_http.c,v 1.123 2018/09/07 09:31:13 florian Exp $ */
+/* $OpenBSD: server_http.c,v 1.124 2018/10/01 19:24:09 benno Exp $ */
 
 /*
  * Copyright (c) 2006 - 2018 Reyk Floeter <[hidden email]>
@@ -88,6 +88,7 @@ server_httpdesc_init(struct client *clt)
  }
  RB_INIT(&desc->http_headers);
  clt->clt_descresp = desc;
+ clt->clt_toread = TOREAD_HTTP_INIT;
 
  return (0);
 }
@@ -211,6 +212,10 @@ server_read_http(struct bufferevent *bev, void *arg)
  size = EVBUFFER_LENGTH(src);
  DPRINTF("%s: session %d: size %lu, to read %lld",
     __func__, clt->clt_id, size, clt->clt_toread);
+
+ if (clt->clt_toread == TOREAD_HTTP_INIT)
+ clt->clt_toread = TOREAD_HTTP_HEADER;
+
  if (!size) {
  clt->clt_toread = TOREAD_HTTP_HEADER;
  goto done;
@@ -734,6 +739,7 @@ server_reset_http(struct client *clt)
  server_httpdesc_free(clt->clt_descresp);
  clt->clt_headerlen = 0;
  clt->clt_headersdone = 0;
+ clt->clt_toread = TOREAD_HTTP_INIT;
  clt->clt_done = 0;
  clt->clt_line = 0;
  clt->clt_chunk = 0;