Hi,
while testing the -current (I also see the issue on 5.7) httpd with a
fuzzer I noticed that some HTTP requests result in the session not
closing properly.
I've attached inline a Python script that should demostrate the issue.
I've tested the issue locally and from adjacent network.
After running the Python script against httpd for a couple of times you
should see the following in `fstat'.
$ fstat | grep '^www'
* snip*
www httpd 26860 3* internet stream tcp 0x0 *:80
www httpd 26860 4* unix stream 0x0
www httpd 26860 5* internet stream tcp 0x0 *:0
www httpd 26860 6* internet stream tcp 0x0 *:0
www httpd 26860 7* unix stream 0x0
www httpd 26860 8* internet stream tcp 0x0 *:0
www httpd 26860 9 kqueue 0x0 0 state: W
www httpd 26860 10* internet stream tcp 0x0 *:0
www httpd 26860 11* internet stream tcp 0x0 *:0
www httpd 26860 12* internet stream tcp 0x0 *:0
www httpd 26860 13* internet stream tcp 0x0 *:0
www httpd 26860 14* internet stream tcp 0x0 *:0
www httpd 26860 15* internet stream tcp 0x0 *:0
Note the sockets #10-#15.
Normally I would provide a patch when reporting issues but I've been
trying to debug this for a while and I thought reporting this now
would make it possible to get it fixed before release.
---8<--------sock-httpd.py--------------------------------------------
#!/usr/bin/python
import sys
import socket
import struct
def send_payload(s):
s.send("GET / HTTP/1.1\r\nKeep-Alive: 300\r\nAuthorization: Negotiate ")
s.send("")
s.send("A" * 32767)
s.send("")
s.send("A" * 32767)
s.send("")
s.send("A" * 32767)
s.send("")
def wait(s):
try:
s.recv(1024)
except:
pass
def main():
if len(sys.argv) < 3:
print "usage:", sys.argv[0], "<target> <port>"
sys.exit(1)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0)
s.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER, struct.pack('ii', 1, 0))
s.settimeout(0.2)
s.connect((sys.argv[1], int(sys.argv[2])))
send_payload(s)
wait(s)
s.close()
main()
---8<--------sock-httpd.py--------------------------------------------
---8<--------httpd.conf-----------------------------------------------
# $OpenBSD: httpd.conf,v 1.11 2014/08/25 14:27:54 reyk Exp $
prefork 1
# A minimal default server
server "default" {
listen on * port 80
directory auto index
}
# Include MIME types instead of the built-in ones
types {
include "/usr/share/misc/mime.types"
}
---8<--------httpd.conf-----------------------------------------------
---8<--------dmesg----------------------------------------------------
OpenBSD 5.8 (GENERIC.MP) #1234: Thu Aug 6 09:26:52 MDT 2015
dera...@amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC.MP
real mem = 2087387136 (1990MB)
avail mem = 2020290560 (1926MB)
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 2.4 @ 0xe0010 (63 entries)
bios0: vendor LENOVO version "7NETC1WW (2.21 )" date 10/09/2009
bios0: LENOVO 766734G
acpi0 at bios0: rev 2
acpi0: sleep states S0 S3 S4 S5
acpi0: tables DSDT FACP SSDT ECDT TCPA APIC MCFG HPET SLIC BOOT ASF! SSDT SSDT
SSDT SSDT SSDT
acpi0: wakeup devices LID_(S3) SLPB(S3) DURT(S3) IGBE(S4) EXP0(S4) EXP1(S4)
EXP2(S4) EXP3(S4) EXP4(S4) PCI1(S4) USB0(S3) USB1(S3) USB2(S3) USB3(S3)
USB4(S3) EHC0(S3) [...]
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpiec0 at acpi0
acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Core(TM)2 Duo CPU L7500 @ 1.60GHz, 1795.83 MHz
cpu0:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,NXE,LONG,LAHF,PERF,SENSOR
cpu0: 4MB 64b/line 16-way L2 cache
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 8 var ranges, 88 fixed ranges
cpu0: apic clock running at 199MHz
cpu0: mwait min=64, max=64, C-substates=0.2.2.2.2, IBE
cpu1 at mainbus0: apid 1 (application processor)
cpu1: Intel(R) Core(TM)2 Duo CPU L7500 @ 1.60GHz, 1596.01 MHz
cpu1:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,NXE,LONG,LAHF,PERF,SENSOR
cpu1: 4MB 64b/line 16-way L2 cache
cpu1: smt 0, core 1, package 0
ioapic0 at mainbus0: apid 1 pa 0xfec00000, version 20, 24 pins
ioapic0: misconfigured as apic 2, remapped to apid 1
acpimcfg0 at acpi0 addr 0xf0000000, bus 0-63
acpihpet0 at acpi0: 14318179 Hz
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus -1 (AGP_)
acpiprt2 at acpi0: bus 2 (EXP0)
acpiprt3 at acpi0: bus 3 (EXP1)
acpiprt4 at acpi0: bus -1 (EXP2)
acpiprt5 at acpi0: bus -1 (EXP3)
acpiprt6 at acpi0: bus -1 (EXP4)
acpiprt7 at acpi0: bus 5 (PCI1)
acpicpu0 at acpi0: !C3(250@17 mwait.3@0x20), !C2(500@1 mwait.1@0x10), C1(1000@1
mwait.1), PSS
acpicpu1 at acpi0: !C3(250@17 mwait.3@0x20), !C2(500@1 mwait.1@0x10), C1(1000@1
mwait.1), PSS
acpipwrres0 at acpi0: PUBS, resource for USB0, USB2, USB4, EHC0, EHC1
acpitz0 at acpi0: critical temperature is 127 degC
acpitz1 at acpi0: critical temperature is 99 degC
acpibtn0 at acpi0: LID_
acpibtn1 at acpi0: SLPB
acpibat0 at acpi0: BAT0 model "92P1163" serial 1439 type LION oem "SANYO"
acpibat1 at acpi0: BAT1 not present
acpibat2 at acpi0: BAT2 not present
acpiac0 at acpi0: AC unit online
acpithinkpad0 at acpi0
acpidock0 at acpi0: GDCK not docked (0)
cpu0: Enhanced SpeedStep 1795 MHz: speeds: 1601, 1600, 1200, 800 MHz
pci0 at mainbus0 bus 0
pchb0 at pci0 dev 0 function 0 "Intel GM965 Host" rev 0x0c
vga1 at pci0 dev 2 function 0 "Intel GM965 Video" rev 0x0c
intagp0 at vga1
agp0 at intagp0: aperture at 0xe0000000, size 0x10000000
inteldrm0 at vga1
drm0 at inteldrm0
inteldrm0: 1024x768
wsdisplay0 at vga1 mux 1: console (std, vt100 emulation)
wsdisplay0: screen 1-5 added (std, vt100 emulation)
"Intel GM965 Video" rev 0x0c at pci0 dev 2 function 1 not configured
em0 at pci0 dev 25 function 0 "Intel ICH8 IGP M AMT" rev 0x03: msi, address
00:16:d3:c4:5f:ac
uhci0 at pci0 dev 26 function 0 "Intel 82801H USB" rev 0x03: apic 1 int 20
uhci1 at pci0 dev 26 function 1 "Intel 82801H USB" rev 0x03: apic 1 int 21
ehci0 at pci0 dev 26 function 7 "Intel 82801H USB" rev 0x03: apic 1 int 22
usb0 at ehci0: USB revision 2.0
uhub0 at usb0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
azalia0 at pci0 dev 27 function 0 "Intel 82801H HD Audio" rev 0x03: msi
azalia0: codecs: Analog Devices AD1984, Conexant/0x2bfa, using Analog Devices
AD1984
audio0 at azalia0
ppb0 at pci0 dev 28 function 0 "Intel 82801H PCIE" rev 0x03: msi
pci1 at ppb0 bus 2
ppb1 at pci0 dev 28 function 1 "Intel 82801H PCIE" rev 0x03: msi
pci2 at ppb1 bus 3
iwn0 at pci2 dev 0 function 0 "Intel Wireless WiFi Link 4965" rev 0x61: msi,
MIMO 2T3R, MoW2, address 00:1d:e0:52:62:67
uhci2 at pci0 dev 29 function 0 "Intel 82801H USB" rev 0x03: apic 1 int 16
uhci3 at pci0 dev 29 function 1 "Intel 82801H USB" rev 0x03: apic 1 int 17
ehci1 at pci0 dev 29 function 7 "Intel 82801H USB" rev 0x03: apic 1 int 19
usb1 at ehci1: USB revision 2.0
uhub1 at usb1 "Intel EHCI root hub" rev 2.00/1.00 addr 1
ppb2 at pci0 dev 30 function 0 "Intel 82801BAM Hub-to-PCI" rev 0xf3
pci3 at ppb2 bus 5
cbb0 at pci3 dev 0 function 0 "Ricoh 5C476 CardBus" rev 0xba: apic 1 int 16
"Ricoh 5C832 Firewire" rev 0x04 at pci3 dev 0 function 1 not configured
sdhc0 at pci3 dev 0 function 2 "Ricoh 5C822 SD/MMC" rev 0x21: apic 1 int 18
sdmmc0 at sdhc0
cardslot0 at cbb0 slot 0 flags 0
cardbus0 at cardslot0: bus 6 device 0 cacheline 0x8, lattimer 0xb0
pcmcia0 at cardslot0
pcib0 at pci0 dev 31 function 0 "Intel 82801HEM LPC" rev 0x03
pciide0 at pci0 dev 31 function 2 "Intel 82801HBM SATA" rev 0x03: DMA, channel
0 wired to compatibility, channel 1 wired to compatibility
wd0 at pciide0 channel 0 drive 0: <SAMSUNG SSD 830 Series>
wd0: 16-sector PIO, LBA48, 122104MB, 250069680 sectors
wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 6
ichiic0 at pci0 dev 31 function 3 "Intel 82801H SMBus" rev 0x03: apic 1 int 23
iic0 at ichiic0
usb2 at uhci0: USB revision 1.0
uhub2 at usb2 "Intel UHCI root hub" rev 1.00/1.00 addr 1
usb3 at uhci1: USB revision 1.0
uhub3 at usb3 "Intel UHCI root hub" rev 1.00/1.00 addr 1
usb4 at uhci2: USB revision 1.0
uhub4 at usb4 "Intel UHCI root hub" rev 1.00/1.00 addr 1
usb5 at uhci3: USB revision 1.0
uhub5 at usb5 "Intel UHCI root hub" rev 1.00/1.00 addr 1
isa0 at pcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5 irq 1 irq 12
pckbd0 at pckbc0 (kbd slot)
wskbd0 at pckbd0: console keyboard, using wsdisplay0
pms0 at pckbc0 (aux slot)
wsmouse0 at pms0 mux 0
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
aps0 at isa0 port 0x1600/31
ugen0 at uhub2 port 2 "STMicroelectronics Biometric Coprocessor" rev 1.00/0.01
addr 2
vscsi0 at root
scsibus1 at vscsi0: 256 targets
softraid0 at root
scsibus2 at softraid0: 256 targets
root on wd0a (7025a19a0df0c450.a) swap on wd0b dump on wd0b
ugen0 detached
uhub2 detached
uhub3 detached
uhub0 detached
uhub4 detached
uhub5 detached
uhub1 detached
uhub0 at usb2 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub1 at usb3 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub2 at usb0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
uhub3 at usb4 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub4 at usb5 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub5 at usb1 "Intel EHCI root hub" rev 2.00/1.00 addr 1
ugen0 at uhub0 port 2 "STMicroelectronics Biometric Coprocessor" rev 1.00/0.01
addr 2
ugen0 detached
uhub0 detached
uhub1 detached
uhub2 detached
uhub3 detached
uhub4 detached
uhub5 detached
uhub0 at usb2 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub1 at usb3 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub2 at usb0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
uhub3 at usb4 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub4 at usb5 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub5 at usb1 "Intel EHCI root hub" rev 2.00/1.00 addr 1
ugen0 at uhub0 port 2 "STMicroelectronics Biometric Coprocessor" rev 1.00/0.01
addr 2
ugen0 detached
uhub0 detached
uhub1 detached
uhub2 detached
uhub3 detached
uhub4 detached
uhub5 detached
uhub0 at usb2 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub1 at usb3 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub2 at usb0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
uhub3 at usb4 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub4 at usb5 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub5 at usb1 "Intel EHCI root hub" rev 2.00/1.00 addr 1
ugen0 at uhub0 port 2 "STMicroelectronics Biometric Coprocessor" rev 1.00/0.01
addr 2
ugen0 detached
uhub0 detached
uhub1 detached
uhub2 detached
uhub3 detached
uhub4 detached
uhub5 detached
uhub0 at usb2 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub1 at usb3 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub2 at usb0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
uhub3 at usb4 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub4 at usb5 "Intel UHCI root hub" rev 1.00/1.00 addr 1
uhub5 at usb1 "Intel EHCI root hub" rev 2.00/1.00 addr 1
ugen0 at uhub0 port 2 "STMicroelectronics Biometric Coprocessor" rev 1.00/0.01
addr 2
---8<--------dmesg----------------------------------------------------
