[Xitami] Xitami DOS reported, fixed

[xitami@lists.xitami.org]

Hello Pieter,

Sorry to bother you on this subject.

At this time I have not updated to the corrected Xitami version for the reported Denial of Service. I am using Xitami V2.5b4 and using the test code reported with the use of nc.exe and the DOS does not occur using Xitami V2.5b4.  (??)

At the time Xitami V2.5b4 was down loaded I did not down load the source code for 
V2.5b4, so I cannot look at the routine http_parse_header (*,*) to see if the problem exists. 

I am curious if this version of Xitami is ok in the routine http_parse_header (*,*) or is it some Xitami DEFAULT management setting I set to make it work????


The only change to the Xitami DEFAULT management settings was to add a few web page descriptions in Virtual Hosts and to require passwords for all users of FTP. All entries for web pages in Virtual Hosts as well as DEFAULTS are set as:

        Password file: BLANK   - blank to disable password protection  
        Case-sensitive passwords?     YES
        Allow directory lists?         NO
        Allow web-based admin?        YES
        IP address mask:*             - eg. 111.222.333.*  
        Superuser password:           - gives FULL ACCESS to ALL RESOURCES  


Here is what happens when the TEST.BAT is used with the string DOS (with no :):

    If the IP address of the Xitami server is used 
    to execute TEST.BAT errors are reported, and if 
    a web page is used the text of that page is 
    returned, as expected. And, the Xitami V2.5b4 
    server continues to run as expected by providing web 
    pages to a client browser and the cpu utilization 
    at the Xitami Server remains at or <1% during 
    idle times. I am using a test server so it can 
    be controlled with respect to other browser accesses. 

The following are the outputs from the Xitami Server when TEST.BAT is executed with the ip address of the Xitami Server:

   C:\JLong\NetCat>test 10.10.10.2 80
   HTTP/1.1 403 Forbidden
   Server: Xitami
   Date: Thu, 29 Jul 2004 17:09:06 GMT
   Content-length: 111
   Content-type: text/html
   
   <HTML><TITLE>Error</TITLE><BODY><H1>
   
   You are not authorised to access this resource

   </H1></BODY></HTML>
   
   C:\JLong\NetCat>


Thanks for your help, time and advise!!! :) :)

Jerry

>.
>.
>.
> 
> The denial of service is this: a malformed header (without the ':') causes the 
> server to enter an endless loop. 
> 
> This DOS affects all versions of Xitami. For those building from source, the 
> affected file is smthttpl.c, and the patch is in the function 
> http_parse_header: 
> 
> char * 
> http_parse_header (HTTP_CONTEXT *p_http, char *header) 
> { 
> ... 
> while (header && *header && *header != '\r') { 
> ... 
> } 
> ++ else 
> ++ break; 
> } 
> return (header); 
> } 
> Pieter Hintjens 
> iMatix Corporation 
> 
>