http: Restrict maximum size of http + headers #6859

1. 
   laanwj commented at 9:48 am on October 20, 2015: member

   Prevent memory exhaustion by sending lots of data. Also add a test to httpbasics.py.

   Closes #6425

2. laanwj added the label RPC on Oct 20, 2015
3. laanwj force-pushed on Oct 20, 2015
4. 
   dcousens commented at 10:10 am on October 20, 2015: contributor

   Will this restrict #6844 such that transactions greater than 8kB will be restricted?
5. in src/httpserver.cpp: in 3ae69defb6 outdated

   416@@ -414,6 +417,7 @@ bool InitHTTPServer()
   417     }
   418 
   419     evhttp_set_timeout(http, GetArg("-rpcservertimeout", DEFAULT_HTTP_SERVER_TIMEOUT));
   420+    evhttp_set_max_headers_size(http, MAX_HEADERS_SIZE);
   

   ---

   ---

   

   dcousens commented at 10:11 am on October 20, 2015:

   Wait, this PR is only further restricting the headers. Shouldn’t the title be then: “http: Restrict maximum size of headers”

   ---

   

   pstratem commented at 1:51 am on October 21, 2015:

   This should also be restricting the body size, but to something much larger.

   Edit: derp it is below!

6. 
   laanwj commented at 10:29 am on October 20, 2015: member

   To be precise, it restricts the size of request line + headers, the first part of the request. The body is limited separately (to a much larger size).

   #6844 should use POST data to submit the transaction, which is not affected by this.

7. 
   jgarzik commented at 12:25 pm on October 20, 2015: contributor

   ut ACK - agree “http + headers” in commit msg seemed to imply http body
8. http: Restrict maximum size of request line + headers

   Prevent memory exhaustion by sending lots of data.
   Also add a test to `httpbasics.py`.
   
   Closes #6425

   41db8c4733
9. laanwj force-pushed on Oct 20, 2015
10. 
    laanwj commented at 12:34 pm on October 20, 2015: member

    Updated the ocmmit message
11. 
    sipa commented at 12:37 pm on October 20, 2015: member

    utACK
12. 
    dcousens commented at 1:46 am on October 21, 2015: contributor

    ACK
13. 
    pstratem commented at 1:52 am on October 21, 2015: contributor

    utACK
14. laanwj merged this on Oct 21, 2015
15. laanwj closed this on Oct 21, 2015

    ---

16. laanwj referenced this in commit 0fbfc5106c on Oct 21, 2015
17. sickpig referenced this in commit 46b5b86be5 on Mar 9, 2018
18. sickpig referenced this in commit dadc2880a1 on Mar 9, 2018
19. sickpig referenced this in commit 6d4a55878a on Mar 12, 2018
20. sickpig referenced this in commit 6db640a393 on Mar 12, 2018
21. sickpig referenced this in commit 76cf243311 on Mar 12, 2018
22. sickpig referenced this in commit 4428056252 on Mar 12, 2018
23. marlengit referenced this in commit 297ac08c3a on Sep 25, 2018
24. zkbot referenced this in commit faf3825eed on Sep 30, 2020
25. zkbot referenced this in commit a983344931 on Oct 1, 2020
26. DrahtBot locked this on Sep 8, 2021

Contributors
laanwj dcousens pstratem jgarzik sipa

Labels
RPC/REST/ZMQ