bugGNU Wget - Bugs: bug #20523, wget ignores timeout on HTTPS...

 
 

bug #20523: wget ignores timeout on HTTPS connections

Submitter:  Noël Köthe <nok>
Submitted:  Wed 18 Jul 2007 07:53:08 PM UTC
   
 
Category:  User Interface Severity:  3 - Normal
Priority:  4 Status:  None
Privacy:  Public Assigned to:  None
Originator Name:  Open/Closed:  Open
Release:  1.10.2 Operating System:  GNU/Linux
Reproducibility:  None Fixed Release:  None
Planned Release:  1.14 Regression:  None
Work Required:  1 - Days Patch Included:  Yes
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Tue 12 Jan 2016 10:47:21 PM UTC, comment #6: 

Oh, sorry for the messed markup.
The same without markup:

1) Make default TCP send buffer less than wget send buffer (which is 8192):
echo "4096 4096 4096" > /proc/sys/net/ipv4/tcp_wmem

2) Generate a sample file larger than TCP send buffer:
dd if=/dev/urandom of=./qqq.junk bs=10M count=1

3) Setup firewall rules to drop large outgoing packets to allow for successful SSL handshake while blocking bulk uploads:
iptables -I OUTPUT -d <your_https_server> -m length --length 1000:1500 -j DROP

4) Run wget to send bulk data:
wget --timeout=10 --tries=1 --post-file qqq.junk -O /dev/null --no-check-certificate 'https://<your_https_server>'

5) Observe wget ignoring the 10 second timeout.

Andrey Mazo <ahippo>
Tue 12 Jan 2016 10:41:29 PM UTC, comment #5: 

Just in case someone needs a test case for openssl_write() ignoring the timeout, here it is.
Seems to be reproducible with wget-1.17.1.
It's quite unlikely to happen in the real world but anyway.

1) Make default TCP send buffer less than wget send buffer (which is 8192):

echo "4096 4096 4096" > /proc/sys/net/ipv4/tcp_wmem

2) Generate a sample file larger than TCP send buffer:

dd if=/dev/urandom of=./qqq.junk bs=10M count=1

3) Setup firewall rules to drop large outgoing packets to allow for successful SSL handshake while blocking bulk uploads:

iptables -I OUTPUT -d <your_https_server> -m length --length 1000:1500 -j DROP

4) Run wget to send bulk data:

wget --timeout=10 --tries=1 --post-file qqq.junk -O /dev/null --no-check-certificate 'https://<your_https_server>'

5) Observe wget ignoring the 10 second timeout.

Andrey Mazo <ahippo>
Sun 30 Aug 2009 08:57:26 AM UTC, comment #4: 

Needs to wait on disclaimer papers. :(

Micah Cowan <micahcowan>
Thu 21 Aug 2008 11:17:41 PM UTC, comment #3: 

Patch in 1.12, then retarget for later for a "real" fix.

Micah Cowan <micahcowan>
Sat 23 Feb 2008 04:12:33 AM UTC, comment #2: 

I ran into this today in 1.11.  I applied John's patch, but I was seeing it hang past the handshake during reads.

To reproduce, start wget downloading over ssl with a timeout set:
 wget --timeout=10 -O /dev/null https://...
Then drop the interface:
 ifconfig eth0 down

Over http, the connection times out correctly; over https, it hangs.

Building on John's proposal to use run_with_timeout(), I wrapped openssl_read() as well.  This solves the problems I was having.  I agree that, for correctness, we should probably wrap openssl_write() as well, although I don't have a failing test case.

(file #15097)

Rick Schultz <rschultz>
Fri 14 Sep 2007 04:35:07 PM UTC, comment #1: 

Attaching a proposed fix which requires the entire SSL handshake to be completed within the read timeout.  A better fix would apply the timeout individually to each underlying read and write, but the proposed fix is much better than the existing code.

(file #13946)

John Gardiner Myers <jgmyers>
Wed 18 Jul 2007 07:53:08 PM UTC, original submission:  

Hello,

http://bugs.debian.org/385506

"This is easy to reproduce, just start downloading a largish file with a --read-timeout of a few seconds, and right in the middle drop traffic from that server using iptables.

Stracing an HTTP connection shows nice timeout:

20:34:04 read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 16384) = 1398
20:34:04 write(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1398) = 1398
20:34:04 select(5, [4], NULL, NULL, {15, 0}) = 1 (in [4], left {14, 988000})
20:34:04 read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 16384) = 1398
20:34:04 write(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1398) = 1398
20:34:04 select(5, [4], NULL, NULL, {15, 0}) = 0 (Timeout)
20:34:19 close(4)                       = 0

While HTTPS just sits there forever, waiting:

20:28:38 read(4, "\30.\3051\330\307L\301%\206\312\347\326\277i&\250[\025"..., 3852) = 3852
20:28:39 write(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096) = 4096
20:28:39 write(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 12288) = 12288
20:28:39 select(5, [4], NULL, NULL, {15, 0}) = 1 (in [4], left {15, 0})
20:28:39 read(4, "\27\3\0011p", 5)      = 5
20:28:39 read(4, "\314\247\266\315\235?K\210\217\317\0014F\\\371J\273*\252"..., 12656) = 1735
20:28:39 read(4, "xT\263pU=\354~W\225\344\237\271\237a%\22\327\326)D\231"..., 10921) = 1398
20:28:39 read(4, "]\303\254\251\354\223#c\304\247E\260\33\326\362\376\374"..., 9523) = 1398
20:28:39 read(4,

Probably the timeout is not implemented in the routine which uses libssl...

Since the TCP internal timeout for an ESTABLISHED connection is very very large as I remember, this can be very bad for situations where wget is executed non-interactively (in my case, I update my dyndns entry using wget and reset my wireless card in a loop, in case something bad happens to the internet connection, which worked nice, until wget hanged this afternoon).
"

thx.

Noël Köthe <nok>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #13947:  listentest.pl added by jgmyers (214B - text/x-perl - Perl "server" for testing)
file #13946:  wget-1.10.2-ssltimeout.patch added by jgmyers (1KiB - application/octet-stream - Proposed fix)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ahippo (Posted a comment)
  • -email is unavailable- added by rschultz (Updated the item)
  • -email is unavailable- added by jgmyers (Updated the item)
  • -email is unavailable- added by micahcowan (Updated the item)
  • -email is unavailable- added by nok (Submitted the item)
  •  

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-08-30 micahcowan Planned Release1.12 1.14
    2008-11-04 micahcowan Priority7 - High 4
    2008-02-23 rschultz Attached File- Added openssl-1.11-sslreadtimeout.patch, #15097
    2007-09-14 jgmyers Attached File- Added listentest.pl, #13947
    2007-09-14 micahcowan Patch IncludedNone Yes
    2007-09-14 jgmyers Attached File- Added wget-1.10.2-ssltimeout.patch, #13946
    2007-08-01 micahcowan Priority5 - Normal 7 - High
    2007-07-21 micahcowan Work RequiredNone 1 - Days
    2007-07-20 micahcowan Planned ReleaseNone 1.12

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code