Bug 38837 - post data >8k overflow via mod_ssl and mod_proxy ProxyPass
Summary: post data >8k overflow via mod_ssl and mod_proxy ProxyPass
Status: RESOLVED DUPLICATE of bug 37145
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: Core (show other bugs)
Version: 2.0.55
Hardware: PC FreeBSD
: P2 normal (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2006-03-03 09:51 UTC by Aragon Gouveia
Modified: 2006-03-03 06:14 UTC (History)
0 users



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Aragon Gouveia 2006-03-03 09:51:58 UTC
Hi,

When data exceeding 8192 bytes is posted to a ProxyPass'd URL in an SSL 
virtualhost, mod_proxy or mod_ssl overflows the data and transforms it in such 
a way that it is useless after it is proxied.

I am able to consistently reproduce this as follows.

In a SSL virtualhost block:
<Location /test.cgi>
   ProxyPass http://127.0.0.1:9010/test.cgi
</Location>

http://127.0.0.1:9010/ is a netcat listener whose output I'm teeing to a file.

I generated post data looking like this:
data=by10te0001by10te0002by10te0003... etc.

Each by10teXXXX is 10 bytes and repeats until the post data is 8200 bytes long 
(including data=).

I submit it with curl:  curl -d $( cat testdata.txt ) 
https://securesite/test.cgi

The tee output from netcat is:
---
POST /test.cgi HTTP/1.1^M
Host: 127.0.0.1:9010^M
User-Agent: curl/7.15.1 (i386-portbld-freebsd5.4) libcurl/7.15.1 OpenSSL/0.9.7e 
zlib/1.2.1^M
Accept: */*^M
Content-Type: application/x-www-form-urlencoded^M
Expect: 100-continue^M
Max-Forwards: 10^M
X-Forwarded-For: <snip>^M
X-Forwarded-Host: <snip>^M
X-Forwarded-Server: <snip>^M
Content-Length: 8200^M
^M
819by10t0te0001by10te0002by10te0003<snip>by10te0818by10te0819by10t
---

I've <snip>'d information for briefness sake.

The post data comes out to 8200 bytes long, but has overflowed in some way and 
been transformed.

If I perform this post to a ProxyPass that does not run in an SSL virtualhost, 
it goes through unaltered.


Thanks,
Aragon
Comment 1 Ruediger Pluem 2006-03-03 15:14:40 UTC

*** This bug has been marked as a duplicate of 37145 ***