Bug 36742 - Missing diagnostics in InternalInputBuffer on overly long headers
Summary: Missing diagnostics in InternalInputBuffer on overly long headers
Status: RESOLVED FIXED
Alias: None
Product: Tomcat 5
Classification: Unclassified
Component: Connector:HTTP (show other bugs)
Version: 5.0.28
Hardware: Other other
: P5 normal (vote)
Target Milestone: ---
Assignee: Tomcat Developers Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-09-20 21:29 UTC by Greg Steuck
Modified: 2005-12-02 08:06 UTC (History)
0 users


Attachments
patch that adds a diagnostic message on header-too-long errors (1.05 KB, application/octet-stream)
2005-09-20 21:30 UTC, Greg Steuck 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Greg Steuck 2005-09-20 21:29:22 UTC 
Currently, if a request comes in with a header longer than
maxHttpHeaderSize, Tomcat drops the connection and does not log
anything.

Here is what it looks like from client point of view with the default
maxHttpHeaderSize of 4K.

Overly long header:

% curl  -H "$(perl -e 'print q{X: }, q{a}x10000')" http://tomcat/admin/
curl: (52) Empty reply from server

I am adding a small diagnostic message to catch such cases (patch
attached).

With that patch in place we get a nice message in the logs and we can
grep and see how often we hit the limit:

jvm 1    | Sep 15, 2005 6:51:45 PM org.apache.coyote.http11.InternalInputBuffer fill
jvm 1    | INFO: Request header is too large
Comment 1 Greg Steuck 2005-09-20 21:30:19 UTC 
Created attachment 16467 [details]
patch that adds a diagnostic message on header-too-long errors
Comment 2 Remy Maucherat 2005-09-20 22:27:11 UTC 
Similarly, I don't see the point.
Comment 3 Yoav Shapira 2005-09-22 02:10:16 UTC 
I actually like the diagnostic message, it's helpful.  It should be a rare event
(so no big performance hit from logger.info), but when it does happen, the
developer would want to know...
Comment 4 Remy Maucherat 2005-09-22 07:56:03 UTC 
It would also create a nice way to have the server fills out log files
predictably. Frankly, it's useless.
Comment 5 Tim Funk 2005-09-22 15:06:57 UTC 
Since the patch is logging at the info level - I would guess that most
production environments leave info turned off so the log filling issue wouldn't
be a non-issue.
Comment 6 Remy Maucherat 2005-09-22 15:25:40 UTC 
(In reply to comment #5)
> Since the patch is logging at the info level - I would guess that most
> production environments leave info turned off so the log filling issue wouldn't
> be a non-issue.

Ok.
Comment 7 Yoav Shapira 2005-12-02 17:06:00 UTC 
Fix applied on 5.0 branch.  Thanks for contributing it.