| Subject: | CONNECT is not robust to fragmentation of HTTP headers |
| Date: | Mon, 10 Mar 2008 12:07:06 +0000 |
| To: | bug-Crypt-SSLeay [...] rt.cpan.org |
| From: | Martin Waite <martin.waite [...] datacash.com> |
Hi,
Version Crypt-SSLeay-0.57
In lib/Net/SSL.pm, sub proxy_connect_helper, an attempt is made to read the HTTP headers from the proxy server:
Show quoted text
Show quoted text
Apache appears to send the headers in two separate TCP packets. Mostly, this isn't a problem because by time proxy_connect_helper attempts to read the header, the whole header is available in the O/S buffer. Sometimes, however, the second header hasn't arrived by time the read takes place. When this happens, proxy_connect_helper only removes the first header line from the read buffer, and the remainder of the header is read in by OpenSSL, which causes the hand-shaking to fail.
What I think proxy_connect_helper should do is read until it finds the end of the HTTP headers (CRLF CRLF). This might take many reads, not just a single one.
Version Crypt-SSLeay-0.57
In lib/Net/SSL.pm, sub proxy_connect_helper, an attempt is made to read the HTTP headers from the proxy server:
Show quoted text
my $header;
my $n = $self->SUPER::sysread($header, 8192);
my $conn_ok = ($header =~ /HTTP\/\d+\.\d+\s+200\s+/is) ? 1 : 0;
if (not $conn_ok) {
croak("PROXY ERROR HEADER, could be non-SSL URL:\n$header");
}
For our system, using apache 2 as an SSL proxy, the 2 HTTP headers (and a blank line) are returned:
Show quoted text
HTTP/1.0 200 Connection establishedCRLF Proxy-agent: ApacheCRLF CRLF
Apache appears to send the headers in two separate TCP packets. Mostly, this isn't a problem because by time proxy_connect_helper attempts to read the header, the whole header is available in the O/S buffer. Sometimes, however, the second header hasn't arrived by time the read takes place. When this happens, proxy_connect_helper only removes the first header line from the read buffer, and the remainder of the header is read in by OpenSSL, which causes the hand-shaking to fail.
What I think proxy_connect_helper should do is read until it finds the end of the HTTP headers (CRLF CRLF). This might take many reads, not just a single one.
--
Martin Waite
Solutions Architect
DataCash
Tel (Direct): +44 (0)131 538 8431
Mobile: +44 (0)7866 750509
DataCash Ltd, Suite 3/1 Great Michael House,
14 Links Place, Edinburgh, EH6 7EZ, United Kingdom.
Tel: +44 (0)870 7274 762
Fax: +44 (0)870 7274 782
www.datacash.com
Solutions Architect
DataCash
Tel (Direct): +44 (0)131 538 8431
Mobile: +44 (0)7866 750509
DataCash Ltd, Suite 3/1 Great Michael House,
14 Links Place, Edinburgh, EH6 7EZ, United Kingdom.
Tel: +44 (0)870 7274 762
Fax: +44 (0)870 7274 782
www.datacash.com
DISCLAIMER: This email and any files transmitted with it are
confidential to DataCash Group plc and its group companies. It is
intended only for the person to whom it is addressed. If you have
received this email in error, please forward it to info@datacash.com
with the
subject line "Received in Error". If you are not the intended
recipient you must not use, disclose, copy, print, distribute or rely
on this email or any transmitted files. DataCash Ltd is registered in
England and Wales no. 3430157. DataCash Ltd is part of the DataCash
Group plc. DataCash Group plc is registered in England and Wales
no. 3168091. DataCash Ltd and DataCash Group plc registered address is
Descartes House, 8 Gate Street, London, WC2A 3HP, United Kingdom.
Save a tree...Please only print this page if essential