net/http: GET request hangs if "Content-Length" reqest-header field ist set (possible DoS vulnerability) #33269

je4 · 2019-07-24T16:35:01Z

What version of Go are you using (`go version`)?

PS C:\WINDOWS\System32> go version
go version go1.12.7 windows/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (`go env`)?

go env Output

PS C:\WINDOWS\System32> go env
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\juergen.enge\AppData\Local\go-build
set GOEXE=.exe
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOOS=windows
set GOPATH=C:\daten\go
set GOPROXY=
set GORACE=
set GOROOT=c:\go
set GOTMPDIR=
set GOTOOLDIR=c:\go\pkg\tool\windows_amd64
set GCCGO=gccgo
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -fmessage-length=0 -fdebug-prefix-map=C:\Users\JUERGE~1.ENG\AppData\Local\Temp\go-build111174446=/tmp/go-build -gno-record-gcc-switches

What did you do?

sending a GET request to the native go http server with "Content-length" request parameter

package main

import (
	"log"
	"net/http"
)

func main() {
	server := &http.Server{Addr: "localhost:80"}

	log.Fatal(server.ListenAndServe())

}

What did you expect to see?

immediate response with error code 404 page not found (<2ms)

What did you see instead?

request hangs for very long time (>1min, client kills connection).

Initial debugging

it seems, that the function call w.finishRequest() in func (c *conn) serve(ctx context.Context) from server.go does not return. There is a problem in flushing the write buffer...

The text was updated successfully, but these errors were encountered:

av86743 · 2019-07-24T17:02:15Z

If you are sending non-zero Content-Length and not providing data of that length, what else would you expect?

je4 · 2019-07-24T17:33:47Z

since a request body does not make any sense in most cases for a GET request, the idle-timeout for waiting for the body data could be automatically decreased.
with the actual status, i feel, that most golang webservers could have a problem with long running requests if there are many of them...
if you are using a handler which does not read the request body, the handler is finished while the system is waiting for the request body...

FiloSottile · 2019-07-30T14:06:20Z

For this to be a security issue, it should bypass the server timeouts, as otherwise there are a number of ways to get the server to wait until the timeout.

Could you provide the code or command you are using to generate the request?

je4 · 2019-08-01T14:14:21Z

i have used the "Advanced REST Client" (https://install.advancedrestclient.com/install)
the content-length variable remained while switching from POST to GET

je4 · 2019-08-01T14:30:22Z

Further investigation shows, that an nginx server which serves static files seems to ignore this field. nginx with php-fpm activated folder shows the same behaviour...

https://www.google.com/ (Error 400 (Bad Request)!!1)
https://www.spiegel.de (server timeout: ~5sec, then displays normal page)
https://www.cnn.com (client timeout)
https://www.ibm.com (seems to ignore field)
https://www.microsoft.com (seems to ignore field)
https://www.facebook.com (client timeout)
https://www.twitter.com (Error 400 Bad Request)

lucasmoten · 2019-08-17T04:49:04Z

From this..

if you are using a handler which does not read the request body, the handler is finished while the system is waiting for the request body

I believe appropriate course of action is to have all handlers read the request body to the end, and make use of ReadTimeout and ReadHeaderTimeout on Server.

je4 · 2019-08-17T14:17:57Z

I believe appropriate course of action is to have all handlers read the request body to the end, and make use of ReadTimeout and ReadHeaderTimeout on Server.

I am not sure about the definition of "end". If there's a content length given and the data is needed the end correlates with the data length.
Timeout is a very good thing. But for handlers which do not use any request body data I like the "Error 400 Bad Request" solution because no client has any reason to send this data.
This could be done for the handlers shipped with go.

odeke-em · 2019-10-17T01:18:41Z

@je4 thank you for this report! So we've been thinking about this for a while as per #13722 /cc @bradfitz and in 2016 @bradfitz added a great suggestion to perhaps make an opt-in knob #13722 (comment) to accept GET bodies.

My data point to accept bodies with GETs is that in the wild and even widely encouraged is Elastic search which permits GET with bodies e.g. https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-body.html.

Your reference in #33269 (comment) doesn't necessarily apply as apples-to-apples because most of those are consumer sites whereas Go creates web servers so the business logic is what you are comparing yet this is a general purpose web server.

odeke-em · 2019-10-17T01:23:43Z

I'd say let's close this issue and move the discussion and advocacy to issue #13722, please let me know what you think @je4.

je4 changed the title ~~net/http: GET request hangs if "Content-Length" header field ist set (possible DoS vulnerability)~~ net/http: GET request hangs if "Content-Length" reqest-header field ist set (possible DoS vulnerability) Jul 24, 2019

FiloSottile added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jul 30, 2019

FiloSottile added this to the Go1.14 milestone Jul 30, 2019

rsc modified the milestones: Go1.14, Backlog Oct 9, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

net/http: GET request hangs if "Content-Length" reqest-header field ist set (possible DoS vulnerability) #33269

net/http: GET request hangs if "Content-Length" reqest-header field ist set (possible DoS vulnerability) #33269

je4 commented Jul 24, 2019

av86743 commented Jul 24, 2019

je4 commented Jul 24, 2019 •

edited

FiloSottile commented Jul 30, 2019

je4 commented Aug 1, 2019

je4 commented Aug 1, 2019 •

edited

lucasmoten commented Aug 17, 2019

je4 commented Aug 17, 2019 •

edited

odeke-em commented Oct 17, 2019 •

edited

odeke-em commented Oct 17, 2019

net/http: GET request hangs if "Content-Length" reqest-header field ist set (possible DoS vulnerability) #33269

net/http: GET request hangs if "Content-Length" reqest-header field ist set (possible DoS vulnerability) #33269

Comments

je4 commented Jul 24, 2019

What version of Go are you using (go version)?

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

What did you do?

What did you expect to see?

What did you see instead?

Initial debugging

av86743 commented Jul 24, 2019

je4 commented Jul 24, 2019 • edited

FiloSottile commented Jul 30, 2019

je4 commented Aug 1, 2019

je4 commented Aug 1, 2019 • edited

lucasmoten commented Aug 17, 2019

je4 commented Aug 17, 2019 • edited

odeke-em commented Oct 17, 2019 • edited

odeke-em commented Oct 17, 2019

What version of Go are you using (`go version`)?

What operating system and processor architecture are you using (`go env`)?

je4 commented Jul 24, 2019 •

edited

je4 commented Aug 1, 2019 •

edited

je4 commented Aug 17, 2019 •

edited

odeke-em commented Oct 17, 2019 •

edited