http: body length is the remaining buffer, not Content-Length (breaks pipelining and corrupts bodies)

Aperta
  • Qualcosa non va?
#12,652 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
69/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
c
Ambito
backend, networking

Direzione di ricerca

Start in lib/monkey/mk_server/mk_http_parser.c at the header_content_length body handling described in the issue, then inspect how src/http_server/flb_http_server_http1.c copies the parsed body. Check for existing parser tests covering body lengths and buffered follow-up bytes. Done means the parsed body ends at Content-Length and remaining buffered bytes can be processed as the next request without corrupting the body.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Bug Report

Describe the bug

The HTTP parser sets the request body length to everything remaining in the buffer instead of to
Content-Length. Any bytes buffered after the declared body — a pipelined request, or just extra data — become
part of the body. Depending on the content type this either corrupts the payload or breaks the request outright,
and the pipelined request is then never processed.

To Reproduce

One connection, Content-Type: application/json, Content-Length: 7, body {"a":1}, followed immediately by
three extra bytes:

POST / HTTP/1.1
Host: x
Content-Type: application/json
Content-Length: 7

{"a":1}ZZZ

Result: 400 Bad Request, and the log says invalid JSON message, skipping — the body handed to the JSON
parser was {"a":1}ZZZ, not {"a":1}.

With Content-Type: application/x-www-form-urlencoded the same trailing bytes are silently absorbed into the
last field instead (that is issue #12650, which is a symptom of this), and a pipelined request is swallowed
entirely.

Root cause

lib/monkey/mk_server/mk_http_parser.c:

if (p->header_content_length > 0) {

    p->body_received = len - p->start;              /* everything left in the buffer */
    if ((len - p->start) < p->header_content_length) {
        return MK_HTTP_PARSER_PENDING;
    }

    /* Cut off */
    p->i += p->body_received;
    req->data.len  = p->body_received;              /* so the body is too long */
    req->data.data = (buffer + p->start);
}

len is buf_len. body_received should be p->header_content_length; the check above it only uses
len - p->start to decide whether enough data has arrived.

src/http_server/flb_http_server_http1.c then copies inner_request.data.len bytes straight into the request
body, so the over-long length propagates.

Expected behavior

req->data.len should be p->header_content_length, and p->i should advance by that amount so the remaining
bytes stay buffered for the next request.

Your Environment

  • Fluent Bit 5.1.5 (fluent/fluent-bit:latest); identical on current master
  • Linux, aarch64, official container image
  • Input: http plugin, default settings

Impact

Pre-auth. Content-Length is effectively ignored for framing: any request that shares a buffer with following
bytes gets a corrupted body, and pipelined requests are lost. For JSON it is an outright 400; for urlencoded it
is silent record corruption. It is also the root cause of #12650.

Lingua principale
C
Stelle
8.2k
Fork
2k
Merge medio
3g 20h
PR unite (30g)
99

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di fluent/fluent-bit

Tutte le issue di fluent/fluent-bit

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.