bugGNU Wget - Bugs: bug #20523, wget ignores timeout on HTTPS...

 
 

bug #20523: wget ignores timeout on HTTPS connections

Submitted by:  Noël Köthe <nok>
Submitted on:  Wed 18 Jul 2007 07:53:08 PM UTC  
 
Category: User InterfaceSeverity: 3 - Normal
Priority: 4Status: None
Privacy: PublicAssigned to: None
Originator Name: Open/Closed: Open
Release: 1.10.2Operating System: GNU/Linux
Reproducibility: NoneFixed Release: None
Planned Release: 1.14Regression: None
Work Required: 1 - DaysPatch Included: Yes

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Tue 12 Jan 2016 10:47:21 PM UTC, comment #6:

Oh, sorry for the messed markup.
The same without markup:

1) Make default TCP send buffer less than wget send buffer (which is 8192):
echo "4096 4096 4096" > /proc/sys/net/ipv4/tcp_wmem

2) Generate a sample file larger than TCP send buffer:
dd if=/dev/urandom of=./qqq.junk bs=10M count=1

3) Setup firewall rules to drop large outgoing packets to allow for successful SSL handshake while blocking bulk uploads:
iptables -I OUTPUT -d <your_https_server> -m length --length 1000:1500 -j DROP

4) Run wget to send bulk data:
wget --timeout=10 --tries=1 --post-file qqq.junk -O /dev/null --no-check-certificate 'https://<your_https_server>'

5) Observe wget ignoring the 10 second timeout.

Andrey Mazo <ahippo>
Tue 12 Jan 2016 10:41:29 PM UTC, comment #5:

Just in case someone needs a test case for openssl_write() ignoring the timeout, here it is.
Seems to be reproducible with wget-1.17.1.
It's quite unlikely to happen in the real world but anyway.

1) Make default TCP send buffer less than wget send buffer (which is 8192):
2) Generate a sample file larger than TCP send buffer:
3) Setup firewall rules to drop large outgoing packets to allow for successful SSL handshake while blocking bulk uploads:
4) Run wget to send bulk data:
5) Observe wget ignoring the 10 second timeout.

Andrey Mazo <ahippo>
Sun 30 Aug 2009 08:57:26 AM UTC, comment #4:

Needs to wait on disclaimer papers. :(

Micah Cowan <micahcowan>
Thu 21 Aug 2008 11:17:41 PM UTC, comment #3:

Patch in 1.12, then retarget for later for a "real" fix.

Micah Cowan <micahcowan>
Sat 23 Feb 2008 04:12:33 AM UTC, comment #2:

I ran into this today in 1.11. I applied John's patch, but I was seeing it hang past the handshake during reads.

To reproduce, start wget downloading over ssl with a timeout set:
wget --timeout=10 -O /dev/null https://...
Then drop the interface:
ifconfig eth0 down

Over http, the connection times out correctly; over https, it hangs.

Building on John's proposal to use run_with_timeout(), I wrapped openssl_read() as well. This solves the problems I was having. I agree that, for correctness, we should probably wrap openssl_write() as well, although I don't have a failing test case.

(file #15097)

Rick Schultz <rschultz>
Fri 14 Sep 2007 04:35:07 PM UTC, comment #1:

Attaching a proposed fix which requires the entire SSL handshake to be completed within the read timeout. A better fix would apply the timeout individually to each underlying read and write, but the proposed fix is much better than the existing code.

(file #13946)

John Gardiner Myers <jgmyers>
Wed 18 Jul 2007 07:53:08 PM UTC, original submission:

Hello,

http://bugs.debian.org/385506

"This is easy to reproduce, just start downloading a largish file with a --read-timeout of a few seconds, and right in the middle drop traffic from that server using iptables.

Stracing an HTTP connection shows nice timeout:

20:34:04 read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 16384) = 1398
20:34:04 write(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1398) = 1398
20:34:04 select(5, [4], NULL, NULL, {15, 0}) = 1 (in [4], left {14, 988000})
20:34:04 read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 16384) = 1398
20:34:04 write(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1398) = 1398
20:34:04 select(5, [4], NULL, NULL, {15, 0}) = 0 (Timeout)
20:34:19 close(4) = 0

While HTTPS just sits there forever, waiting:

20:28:38 read(4, "\30.\3051\330\307L\301%\206\312\347\326\277i&\250[\025"..., 3852) = 3852
20:28:39 write(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096) = 4096
20:28:39 write(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 12288) = 12288
20:28:39 select(5, [4], NULL, NULL, {15, 0}) = 1 (in [4], left {15, 0})
20:28:39 read(4, "\27\3\0011p", 5) = 5
20:28:39 read(4, "\314\247\266\315\235?K\210\217\317\0014F\\\371J\273*\252"..., 12656) = 1735
20:28:39 read(4, "xT\263pU=\354~W\225\344\237\271\237a%\22\327\326)D\231"..., 10921) = 1398
20:28:39 read(4, "]\303\254\251\354\223#c\304\247E\260\33\326\362\376\374"..., 9523) = 1398
20:28:39 read(4,

Probably the timeout is not implemented in the routine which uses libssl...

Since the TCP internal timeout for an ESTABLISHED connection is very very large as I remember, this can be very bad for situations where wget is executed non-interactively (in my case, I update my dyndns entry using wget and reset my wireless card in a loop, in case something bad happens to the internet connection, which worked nice, until wget hanged this afternoon).
"

thx.

Noël Köthe <nok>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #13947:  listentest.pl added by jgmyers (214B - text/x-perl - Perl "server" for testing)
file #13946:  wget-1.10.2-ssltimeout.patch added by jgmyers (1KiB - application/octet-stream - Proposed fix)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by ahippo (Posted a comment)
  • -unavailable- added by rschultz (Updated the item)
  • -unavailable- added by jgmyers (Updated the item)
  • -unavailable- added by micahcowan (Updated the item)
  • -unavailable- added by nok (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 30 Aug 2009 08:57:26 AM UTCmicahcowanPlanned Release1.12=>1.14
    Tue 04 Nov 2008 01:31:01 AM UTCmicahcowanPriority7 - High=>4
    Sat 23 Feb 2008 04:12:33 AM UTCrschultzAttached File-=>Added openssl-1.11-sslreadtimeout.patch, #15097
    Fri 14 Sep 2007 04:54:56 PM UTCjgmyersAttached File-=>Added listentest.pl, #13947
    Fri 14 Sep 2007 04:44:06 PM UTCmicahcowanPatch IncludedNone=>Yes
    Fri 14 Sep 2007 04:35:07 PM UTCjgmyersAttached File-=>Added wget-1.10.2-ssltimeout.patch, #13946
    Wed 01 Aug 2007 04:46:25 AM UTCmicahcowanPriority5 - Normal=>7 - High
    Sat 21 Jul 2007 02:36:24 AM UTCmicahcowanWork RequiredNone=>1 - Days
    Fri 20 Jul 2007 03:27:15 AM UTCmicahcowanPlanned ReleaseNone=>1.12

    Back to the top


    Powered by Savane 3.1-cleanup1