HTTP server crashes when If-Modified-Since header is badly composed

Hi all,

I am new to this forum so please let me know how to open a ticket with global IBM support team for my issue.

The problem is that http tasks crashes immediately when the following URL request

http://domino_702_host/icons/vwicon050.gif

is being retrieved by user’s browser with the following string in http-header of the request:

“If-Modified-Since: Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT”

These multiple values instead of one cause the server to issue a fatal thread signal.

The crash is reproduceble with some other *.gif and *.exe files, so the problem is not inside that icon. I’ve found at least 5 problem gifs inside “\icons” directory - vwicon005.gif, 011, 026, 079 etc.

I have tested it aganst 3 servers, all running 702 release on different Windows versions and hardware sets - all of them crashed. Fourth server was 509 - and it is stable until now, i.e. nothing happened with it.

The nsd analysis gave me nothing helpful to understand the root cause until I’ve enabled session logging using “tell http debug session on”. After that I have managed to find the last request fatal thread has started to process before the crash.

This is a very hardly reproduceble bug because users with such wrongly constructed http-headers are also very rare visit our site. So the crashed were very irregular and unpredictable.

I’m posting the extract of “htses_xxxxx” file with defective request:

If-Modified-Since: Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT

User-Agent: Opera/9.01 (Windows NT 5.1; U; ru)

Host: ****omitted

Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1

Accept-Language: ru,en;q=0.9

Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1

Referer: ****omitted

Cookie: ****omitted

Cookie2: $Version=1

TE: deflate, gzip, chunked, identity, trailers

Connection: close

X-Forwarded-For: 192.168.1.10

Via: adk.mv.ru:3128 (Oops 1.5.22)

*** Process Request: Session c247, Thread 9d0, Clock 759422

*** Client IP Address [Hi all,

I am new to this forum so please let me know how to open a ticket with global IBM support team for my issue.

The problem is that http tasks crashes immediately when the following URL request

http://domino_702_host/icons/vwicon050.gif

is being retrieved by user’s browser with the following string in http-header of the request:

“If-Modified-Since: Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT”

These multiple values instead of one cause the server to issue a fatal thread signal.

The crash is reproduceble with some other *.gif and *.exe files, so the problem is not inside that icon. I’ve found at least 5 problem gifs inside “\icons” directory - vwicon005.gif, 011, 026, 079 etc.

I have tested it aganst 3 servers, all running 702 release on different Windows versions and hardware sets - all of them crashed. Fourth server was 509 - and it is stable until now, i.e. nothing happened with it.

The nsd analysis gave me nothing helpful to understand the root cause until I’ve enabled session logging using “tell http debug session on”. After that I have managed to find the last request fatal thread has started to process before the crash.

This is a very hardly reproduceble bug because users with such wrongly constructed http-headers are also very rare visit our site. So the crashed were very irregular and unpredictable.

I’m posting the extract of “htses_xxxxx” file with defective request:

=========start-of-abstract

If-Modified-Since: Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT, Wed, 18 Nov 1998 18:20:42 GMT

User-Agent: Opera/9.01 (Windows NT 5.1; U; ru)

Host: ****omitted

Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1

Accept-Language: ru,en;q=0.9

Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1

Referer: ****omitted

Cookie: ****omitted

Cookie2: $Version=1

TE: deflate, gzip, chunked, identity, trailers

Connection: close

X-Forwarded-For: 192.168.1.10

Via: adk.mv.ru:3128 (Oops 1.5.22)

*** Process Request: Session c247, Thread 9d0, Clock 759422

*** Client IP Address [****omitted], Server IP Address [****omitted]: Session c247, Thread 9d0, Clock 759422

*** Start Request Step: Session c247, Thread 9d0, Clock 759422

*** Raw Request Step: Session c247, Thread 9d0, Clock 759422

*** Pre Authenticate Step: Session c247, Thread 9d0, Clock 759422

*** Authenticate Step: Session c247, Thread 9d0, Clock 759422

*** Post Authenticate Step: Session c247, Thread 9d0, Clock 759422

*** Get Group List Step: Session c247, Thread 9d0, Clock 759422

*** Authorized Server Access Step: Session c247, Thread 9d0, Clock 759422

*** Translate Step: Session c247, Thread 9d0, Clock 759422

*** Post Translate Step: Session c247, Thread 9d0, Clock 759422

*** Authorized Step: Session c247, Thread 9d0, Clock 759422

*** Process Request for User Anonymous: Session c247, Thread 9d0, Clock 759422

*** Calling Url Cache Process Request: Session c247, Thread 9d0, Clock 759422

*** Calling File Process Request: Session c247, Thread 9d0, Clock 759422

=========end-of-abstract

Hope that my input will be useful to improve Domino.

Regards,

Ilya

], Server IP Address [****omitted]: Session c247, Thread 9d0, Clock 759422

*** Start Request Step: Session c247, Thread 9d0, Clock 759422

*** Raw Request Step: Session c247, Thread 9d0, Clock 759422

*** Pre Authenticate Step: Session c247, Thread 9d0, Clock 759422

*** Authenticate Step: Session c247, Thread 9d0, Clock 759422

*** Post Authenticate Step: Session c247, Thread 9d0, Clock 759422

*** Get Group List Step: Session c247, Thread 9d0, Clock 759422

*** Authorized Server Access Step: Session c247, Thread 9d0, Clock 759422

*** Translate Step: Session c247, Thread 9d0, Clock 759422

*** Post Translate Step: Session c247, Thread 9d0, Clock 759422

*** Authorized Step: Session c247, Thread 9d0, Clock 759422

*** Process Request for User Anonymous: Session c247, Thread 9d0, Clock 759422

*** Calling Url Cache Process Request: Session c247, Thread 9d0, Clock 759422

*** Calling File Process Request: Session c247, Thread 9d0, Clock 759422

=========end-of-abstract

Hope that my input will be useful to improve Domino.

Regards,

Ilya

Subject: Technote# 1257251

Technote # 1257251http://www-1.ibm.com/support/docview.wss?rs=477&uid=swg21257251

Subject: Found the bug - thanks

Development has a fix for this and it is now in our standard bug management system for inclusion in the appropriate relase.

Thanks