Bug description:

HTTP POST requests with short Content-Lenght hangs in lateconnect mode.
Example request:

-------------------------------------------
POST http://www.openbsd.org/ HTTP/1.1
Content-Length: 3

foo
-------------------------------------------


Test setup: relayd configured to relay client requests to the internet.
I use a relay which is in lateconnect mode.

$ cat request | nc 127.0.0.1 8888


Bug analysis:
- relay_read_http() reads the Content-Length and sets bev->readcb to
  relay_read_httpcontent().
- At this time the request content is already read into the buffer.
- The buffer callback is never called because there is no further
  event for this buffer.

Proposed Solution:
- use the existing check in line 1513 that checks for remaining data
  and applies the callback.
- do this by not returning immediately after relay_connect() in line 1504

Proposed Patch:
--- src/usr.sbin/relayd/relay.c.r143    2011-12-12 13:43:05.000000000 +0100
+++ src/usr.sbin/relayd/relay.c.new 2011-12-12 13:42:45.000000000 +0100
@@ -1503,7 +1503,6 @@
            }
            if (relay_connect(con) == -1)
                relay_close_http(con, 502, "session failed", 0);
-           return;
        }
    }
    if (con->se_done) {



Happy hacking
  Georg


--
Georg Hoesch, [email protected], +49 (89) 99 19 50-168

GeNUA Gesellschaft f|r Netzwerk - und Unix-Administration mbH
Domagkstr. 7, D-85551 Kirchheim. http://www.genua.de
Tel: (089) 99 19 50-0, Fax: (089) 99 19 50 - 999

Geschdftsf|hrer: Dr. Magnus Harlander, Dr. Michaela Harlander,
Bernhard Schneck. Amtsgericht M|nchen HRB 98238

  • Bugfix for relayd Georg Hoesch
    • Bugfix for relayd (Resend with attachments inline) Georg Hoesch

Reply via email to