From a87cfa6bf170da29dd1773f3cc7aa849f4db32bb Mon Sep 17 00:00:00 2001 From: Jim Jagielski Date: Tue, 6 Sep 2016 17:38:34 +0000 Subject: [PATCH] Merge r1758307, r1758308, r1758309, r1758311 from trunk: mpm_winnt: remove 'data' AcceptFilter in favor of 'connect' The 'data' AcceptFilter optimization instructs Windows to wait until data is received on a connection before completing the AcceptEx operation. Unfortunately, it seems this isn't performed atomically -- AcceptEx "partially" accepts the incoming connection during the wait for data, leaving all other incoming connections in the accept queue. This opens the server to a denial of service. Since the fix for this requires a substantial rearchitecture (likely involving multiple outstanding calls to AcceptEx), disable the 'data' filter for now and replace it with 'connect', which uses the AcceptEx interface but does not wait for data. Users running prior releases of httpd on Windows should explicitly move to a 'connect' AcceptFilter in their configurations if they are currently using the default 'data' filter. Many thanks to mludha, Arthur Ramsey, Paul Spangler, and many others for their assistance in tracking down and diagnosing this issue. PR: 59970 mpm_winnt: remove the AcceptEx data network bucket Follow-up to the prior commit: without an incoming data buffer, the custom network bucket code is now orphaned and we can remove it entirely. This has the added benefit that we are no longer using the internal OVERLAPPED.Pointer field, which is discouraged by the MSDN docs. mpm_winnt: remove duplication of ap_process_connection Further follow-up to the previous commit: now that we no longer patch a network bucket into the brigade, we can revert to calling ap_process_connection() directly instead of duplicating its logic. docs: rebuild Submitted by: jchampion Reviewed/backported by: jim git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1759471 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 3 + docs/manual/mod/core.html.en | 33 +++++++---- docs/manual/mod/core.xml | 33 +++++++---- docs/manual/mod/core.xml.es | 7 ++- docs/manual/mod/core.xml.fr | 2 +- docs/manual/mod/core.xml.ja | 2 +- docs/manual/mod/core.xml.tr | 2 +- server/core.c | 4 ++ server/mpm/winnt/child.c | 106 +++++------------------------------ server/mpm/winnt/mpm_winnt.c | 2 - server/mpm/winnt/mpm_winnt.h | 3 - 11 files changed, 72 insertions(+), 125 deletions(-) diff --git a/CHANGES b/CHANGES index 8f01560a66c..55d4434f0dc 100644 --- a/CHANGES +++ b/CHANGES @@ -2,6 +2,9 @@ Changes with Apache 2.4.24 + *) mpm_winnt: Prevent a denial of service when the 'data' AcceptFilter is in + use by replacing it with the 'connect' filter. PR 59970. [Jacob Champion] + *) mod_cgid: Resolve a case where a short CGI response causes a subsequent CGI to be killed prematurely, resulting in a truncated subsequent response. [Eric Covener] diff --git a/docs/manual/mod/core.html.en b/docs/manual/mod/core.html.en index ae769061a5b..ea2c0a6addf 100644 --- a/docs/manual/mod/core.html.en +++ b/docs/manual/mod/core.html.en @@ -183,20 +183,15 @@ AcceptFilter https data tcp(7) man page.

The default values on Windows are:

- 
AcceptFilter http data
-AcceptFilter https data
+ 
AcceptFilter http connect
+AcceptFilter https connect

Window's mpm_winnt interprets the AcceptFilter to toggle the AcceptEx() - API, and does not support http protocol buffering. There are two values - which utilize the Windows AcceptEx() API and will recycle network - sockets between connections. data waits until data has - been transmitted as documented above, and the initial data buffer and - network endpoint addresses are all retrieved from the single AcceptEx() - invocation. connect will use the AcceptEx() API, also - retrieve the network endpoint addresses, but like none - the connect option does not wait for the initial data - transmission.

+ API, and does not support http protocol buffering. connect + will use the AcceptEx() API, also retrieve the network endpoint + addresses, but like none the connect option + does not wait for the initial data transmission.

On Windows, none uses accept() rather than AcceptEx() and will not recycle sockets between connections. This is useful for @@ -204,6 +199,22 @@ AcceptFilter https data network providers such as vpn drivers, or spam, virus or spyware filters.

+
+

The data AcceptFilter (Windows)

+ +

For versions 2.4.23 and prior, the Windows data accept + filter waited until data had been transmitted and the initial data + buffer and network endpoint addresses had been retrieved from the + single AcceptEx() invocation. This implementation was subject to a + denial of service attack and has been disabled.

+ +

Current releases of httpd default to the connect filter + on Windows, and will fall back to connect if + data is specified. Users of prior releases are encouraged + to add an explicit setting of connect for their + AcceptFilter, as shown above.

+
+

See also