http: Restrict maximum size of http + headers #6859

pull laanwj wants to merge 1 commits into bitcoin:master from laanwj:2015_10_max_http_headers changing 2 files +18 −0

laanwj commented at 9:48 AM on October 20, 2015: member

Prevent memory exhaustion by sending lots of data. Also add a test to httpbasics.py.

Closes #6425
laanwj added the label RPC on Oct 20, 2015
laanwj force-pushed on Oct 20, 2015
dcousens commented at 10:10 AM on October 20, 2015: contributor

~~Will this restrict #6844 such that transactions greater than 8kB will be restricted?~~
in src/httpserver.cpp:None in 3ae69defb6 outdated
```
 416 | @@ -414,6 +417,7 @@ bool InitHTTPServer()
 417 |      }
 418 |  
 419 |      evhttp_set_timeout(http, GetArg("-rpcservertimeout", DEFAULT_HTTP_SERVER_TIMEOUT));
 420 | +    evhttp_set_max_headers_size(http, MAX_HEADERS_SIZE);
```
dcousens commented at 10:11 AM on October 20, 2015:

Wait, this PR is only further restricting the headers. Shouldn't the title be then: "http: Restrict maximum size of headers"

pstratem commented at 1:51 AM on October 21, 2015:

This should also be restricting the body size, but to something much larger.

Edit: derp it is below!
laanwj commented at 10:29 AM on October 20, 2015: member

To be precise, it restricts the size of request line + headers, the first part of the request. The body is limited separately (to a much larger size).

#6844 should use POST data to submit the transaction, which is not affected by this.
jgarzik commented at 12:25 PM on October 20, 2015: contributor

ut ACK - agree "http + headers" in commit msg seemed to imply http body

http: Restrict maximum size of request line + headers

Prevent memory exhaustion by sending lots of data.
Also add a test to `httpbasics.py`.

Closes #6425

41db8c4733

laanwj force-pushed on Oct 20, 2015
laanwj commented at 12:34 PM on October 20, 2015: member

Updated the ocmmit message
sipa commented at 12:37 PM on October 20, 2015: member

utACK
dcousens commented at 1:46 AM on October 21, 2015: contributor

ACK
pstratem commented at 1:52 AM on October 21, 2015: contributor

utACK
laanwj merged this on Oct 21, 2015
laanwj closed this on Oct 21, 2015
laanwj referenced this in commit 0fbfc5106c on Oct 21, 2015
sickpig referenced this in commit 46b5b86be5 on Mar 9, 2018
sickpig referenced this in commit dadc2880a1 on Mar 9, 2018
sickpig referenced this in commit 6d4a55878a on Mar 12, 2018
sickpig referenced this in commit 6db640a393 on Mar 12, 2018
sickpig referenced this in commit 76cf243311 on Mar 12, 2018
sickpig referenced this in commit 4428056252 on Mar 12, 2018
marlengit referenced this in commit 297ac08c3a on Sep 25, 2018
zkbot referenced this in commit faf3825eed on Sep 30, 2020
zkbot referenced this in commit a983344931 on Oct 1, 2020
DrahtBot locked this on Sep 8, 2021

Contributors

Labels