[
https://issues.apache.org/jira/browse/TS-3394?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14326222#comment-14326222
]
Sudheer Vinukonda edited comment on TS-3394 at 2/18/15 7:53 PM:
----------------------------------------------------------------
After some discussion on the IRC, it has been decided to use a knob (defaulting
to the current behavior of allowing non-http responses as valid responses) in
5.3 to avoid compatibility issues within a major release.
Note that, come 6.0, with the removal of HTTP/0.9 support (TS-3327), this knob
is useless (non-http responses will be considered errors), as the current
behavior in which, the non-http response is not parsed, and relies strongly on
the code defaulting to HTTP/0.9, where the response validation checks in
HttpTransact that check for status code etc are by-passed. Once, the HTTP/0.9
support is removed, those checks will fail regardless of the parser returning
error or not.
was (Author: sudheerv):
After some discussion on the IRC, it has been decided to use a knob (defaulting
to the current behavior of allowing non-http responses as valid responses) in
5.3 to avoid compatibility issues within a major release.
Note that, come 6.0, with the removal of HTTP/0.9 support (TS-3327), this knob
is useless (non-http responses will be considered errors), as the current
behavior in which, the non-http response is not parsed and relying strongly on
the code defaulting to HTTP/0.9, where the response validation checks in
HttpTransact that check for status code etc are by-passed. Once, the HTTP/0.9
support is removed, those checks will fail regardless of the parser returning
error or not.
> Return an error on a non-http response
> --------------------------------------
>
> Key: TS-3394
> URL: https://issues.apache.org/jira/browse/TS-3394
> Project: Traffic Server
> Issue Type: Improvement
> Components: HTTP
> Reporter: Sudheer Vinukonda
> Assignee: Sudheer Vinukonda
> Fix For: 5.3.0
>
>
> Currently, ATS does not return an error on a non-http response. For example,
> please see below:
> {code}
> [sudheerv@dev1 trafficserver]$ curl -x localhost:80 127.0.0.1:22
> SSH-2.0-OpenSSH_5.3
> Protocol mismatch.
> {code}
> This may allow someone to detect the services running on different ports.
> Opening this jira to return an error in case of a non-http response. The
> error returned will be something like "502 Invalid HTTP Response".
> The below simple patch fixes this:
> {code}
> diff --git a/proxy/hdrs/HTTP.cc b/proxy/hdrs/HTTP.cc
> index 5933381..9d1ccb6 100644
> --- a/proxy/hdrs/HTTP.cc
> +++ b/proxy/hdrs/HTTP.cc
> @@ -1246,7 +1246,7 @@ http_parser_parse_resp(HTTPParser *parser, HdrHeap
> *heap, HTTPHdrImpl *hh, const
>
> eoh:
> *start = old_start;
> - return PARSE_DONE;
> + return PARSE_ERROR;
>
> done:
> if (!version_start || !version_end) {
> {code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
