Web Images Videos Maps News Shopping Gmail more »
Recently Visited Groups | Help | Sign in
Google Groups Home
comp.lang.ruby
+ new post
About this group
Subscribe to this group
This is a Usenet group - learn more
Potential DoS in cgi.rb with apache & mod_fastcgi
Options
There are currently too many topics in this group that display first. To make this topic appear first, remove this option from another topic.
There was an error processing your request. Please try again.
flag
   5 messages - Collapse all  -  Translate all to Translated (View all originals)
The group you are posting to is a Usenet group. Messages posted to this group will make your email address visible to anyone on the Internet.
Your reply message has not been sent.
Your post was successful
 
From:
To:
Cc:
Followup To:
Add Cc | Add Followup-to | Edit Subject
Subject:
Validation:
For verification purposes please type the characters you see in the picture below or the numbers you hear by clicking the accessibility icon. Listen and type the numbers you hear
 
Xavier  
View profile  
 More options Jan 25 2005, 5:27 pm
Newsgroups: comp.lang.ruby
From: Xavier <n...@nowhere.tld>
Date: Tue, 25 Jan 2005 23:27:33 +0100
Local: Tues, Jan 25 2005 5:27 pm
Subject: Potential DoS in cgi.rb with apache & mod_fastcgi
Reply to author | Forward | Print | Individual message | Show original | Report this message | Find messages by this author
Hi Group,

I am getting many errors like the following in my apache logs:

/usr/lib/ruby/1.8/cgi.rb:725: [BUG] rb_sys_fail() - errno == 0
ruby 1.8.2 (2004-12-25) [i686-linux]

This error occurs whenever the client breaks the connection.
The fastcgi process logs the error and exits with an untrapped signal 6
error message.

This can lead to a DoS because mod_fastcgi will stop spawning fcgi's
whenever processes have failed to keep running for at least 30 seconds.

How could I either prevent cgi.rb from breaking or trap and recover from
the signal 6?
A simple Signal.trap(6) does not work, e.g.

 FCGI.each_cgi do |cgi|
   Signal.trap(6){exit(2)}
   do_CGI(cgi)
 end

does not catch the signal.

Any help greatly appreciated,
Xavier


    Reply to author    Forward  
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Eric Hodel  
View profile  
 More options Jan 25 2005, 6:20 pm
Newsgroups: comp.lang.ruby
From: Eric Hodel <drbr...@segment7.net>
Date: Wed, 26 Jan 2005 08:20:29 +0900
Local: Tues, Jan 25 2005 6:20 pm
Subject: Re: Potential DoS in cgi.rb with apache & mod_fastcgi
Reply to author | Forward | Print | Individual message | Show original | Report this message | Find messages by this author

On 25 Jan 2005, at 14:30, Xavier wrote:

> Hi Group,

> I am getting many errors like the following in my apache logs:

> /usr/lib/ruby/1.8/cgi.rb:725: [BUG] rb_sys_fail() - errno == 0
> ruby 1.8.2 (2004-12-25) [i686-linux]

> This error occurs whenever the client breaks the connection.
> The fastcgi process logs the error and exits with an untrapped signal 6
> error message.

Attach a debugger, and you will see what fcgi.so is doing wrong (errno
is not set properly).

> This can lead to a DoS because mod_fastcgi will stop spawning fcgi's
> whenever processes have failed to keep running for at least 30 seconds.

> How could I either prevent cgi.rb from breaking or trap and recover
> from
> the signal 6?

You don't.  This is Ruby saying "I don't know what's wrong, so I'm
freaking out and dying here and now."

I sent a patch to moonwolf some time ago, but he has not responded...

It turned out that patch is wrong, but I haven't had time to write the
correct patch.  On line 158 of fcgi.c (0.8.5) err needs to be copied to
errno so rb_sys_fail works correctly.

--
Eric Hodel - drbr...@segment7.net - http://segment7.net
FEC2 57F1 D465 EB15 5D6E  7C11 332A 551C 796C 9F04

  PGP.sig
< 1K Download

    Reply to author    Forward  
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Kent Sibilev  
View profile  
 More options Jan 25 2005, 6:34 pm
Newsgroups: comp.lang.ruby
From: Kent Sibilev <ksibi...@bellsouth.net>
Date: Wed, 26 Jan 2005 08:34:58 +0900
Local: Tues, Jan 25 2005 6:34 pm
Subject: Re: Potential DoS in cgi.rb with apache & mod_fastcgi
Reply to author | Forward | Print | Individual message | Show original | Report this message | Find messages by this author
I also noticed that this happens only on FreeBSD. I've never seen this
problem since we moved to Linux.

Cheers,
Kent.

On Jan 25, 2005, at 6:20 PM, Eric Hodel wrote:


    Reply to author    Forward  
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Xavier  
View profile  
 More options Jan 25 2005, 7:18 pm
Newsgroups: comp.lang.ruby
From: Xavier <n...@nowhere.tld>
Date: Wed, 26 Jan 2005 01:18:29 +0100
Local: Tues, Jan 25 2005 7:18 pm
Subject: Re: Potential DoS in cgi.rb with apache & mod_fastcgi
Reply to author | Forward | Print | Individual message | Show original | Report this message | Find messages by this author

Thanks Eric.
Your hint helped me solve the problem.
More tests after a good night of sleep :)

Thanks 100x,
Xavier


    Reply to author    Forward  
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Thursday  
View profile  
 More options Jan 25 2005, 7:56 pm
Newsgroups: comp.lang.ruby
From: Thursday <nos...@nospam.nospam.nospam.nospam.org>
Date: Wed, 26 Jan 2005 00:56:37 GMT
Local: Tues, Jan 25 2005 7:56 pm
Subject: Re: Potential DoS in cgi.rb with apache & mod_fastcgi
Reply to author | Forward | Print | Individual message | Show original | Report this message | Find messages by this author

Kent Sibilev wrote:
> I also noticed that this happens only on FreeBSD. I've never seen this
> problem since we moved to Linux.

> Cheers,
> Kent.

This problem is also in Linux (i686-Linux) according to Xavier's log:

   /usr/lib/ruby/1.8/cgi.rb:725: [BUG] rb_sys_fail() - errno == 0
   ruby 1.8.2 (2004-12-25) [i686-linux]

I hope this gets fixed before some idiot goes around crashing all the
rubyonrails sites that depend on mod_fastcgi.

ALL:  Please post a 'diff -ruN' patch for the fix just in case an
updated version isn't released for a while.


    Reply to author    Forward  
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
End of messages
« Back to Discussions « Newer topic     Older topic »

Google Groups - Google Home - Terms of Service - Privacy Policy
©2009 Google