{"ref":"refs/heads/sv-OTP-9389","commits":[{"author":{"name":"Steve Vinoski","email":"7a4255afd9c57b6683c0a61b60767f34686dfd0a@ieee.org"},"sha":"7a923ed4b89db4ebce31dedd83cb156907196598","message":"honor packet_size for http packet parsing to fix OTP-9389\n\nAllow applications to use a packet_size setting on a socket to control\nacceptable HTTP header line length. This gives them the ability to\naccept HTTP headers larger than the default settings allow, but also\nlets them avoid DOS attacks by accepting header lines only up to\nwhatever length they wish to allow.\n\nWithout this change, if an HTTP request/response line or header\narrives on a socket in http, http_bin, httph, or httph_bin parsing\nmode, and the request/response line or header is too long to fit into\na default inet_drv buffer of 1460 bytes, an unexpected error\noccurs. These problems were described and discussed on\nerlang-questions in June 2011 in this thread:\n\nhttp://erlang.org/pipermail/erlang-questions/2011-June/059563.html\n\nIn the original code, no buffer reallocation occurs to enlarge the\nbuffer, even if packet_size or line_length are set in a way that\nshould allow the HTTP data to be parsed properly. The only available\nworkaround was to collect headers and parse them using\nerlang:decode_packet, but that approach has drawbacks such as having\nto collect all HTTP header data before it can be handed to\ndecode_packet for correct parsing, and also requiring each and every\nErlang web server developer/maintainer to add the workaround to his or\nher web server.\n\nChange the packet parser to honor the packet_size setting for HTTP\nparsing. If packet_size is set, and an HTTP request/response or header\nline exceeds the default 1460 byte TCP buffer limit, return an\nindication to tcp_remain that it should realloc the buffer to enlarge\nit to packet_size. Also fix the HTTP parsing code to properly honor\nline_length by truncating any HTTP request/response or header lines\nthat exceed that setting.\n\nFor backward compatibility, default behavior is unchanged; if an\napplication wants to be able to accept long HTTP header lines, it must\nset packet_size to an appropriate value. Buffer reallocation occurs\nonly when needed, so the original default buffer size in the code is\nstill the default.\n\nMake the line mode parsing honor packet_size as well, for consistency.\n\nAdd new regression tests to the emulator decode_packet suite and also\nto the kernel gen_tcp_misc suite.\n\nThe documentation for packet_size in inet:setopts/2 is already\nsufficient.\n\nMany thanks to Sverker Eriksson for his guidance on how to best fix\nthis bug and also for reviewing a number of patch attempts prior to\nthis one.","url":"https://api.github.com/repos/vinoski/otp/commits/7a923ed4b89db4ebce31dedd83cb156907196598"}],"head":"7a923ed4b89db4ebce31dedd83cb156907196598","push_id":51440737,"size":1}