[Libwebsockets] max_http_header_data

Andy Green andy at warmcat.com
Mon Jul 11 02:19:50 CEST 2016


On Sat, 2016-07-09 at 07:46 +0100, Roger Light wrote:
> Hi Andy,
> Thanks for the explanation. I was indeed asking because a user has
> bumped up against it.

I pushed a patch on master making the default ah pool have 4 members
each with a limit of 4096 bytes of header payload (up from 1024).

https://github.com/warmcat/libwebsockets/commit/bdb16b30fbe4cff934a1922
9853be3dc5c314bb6

Since v1.7 you can decide these numbers from the context creation info
struct at runtime, with .max_http_header_data and
.max_http_header_pool.

The defaults (used if the info members are 0) are set at lws build time
in private-libwebsockets.h

#ifndef LWS_DEF_HEADER_LEN
#define LWS_DEF_HEADER_LEN 4096
#endif
#ifndef LWS_DEF_HEADER_POOL
#define LWS_DEF_HEADER_POOL 4
#endif

before v1.7, there's no pool, so only LWS_DEF_HEADER_LEN was defined
(as 1024).

-Andy

> Cheers,
> Roger
> On 9 Jul 2016 12:37 a.m., "Andy Green" <andy at warmcat.com> wrote:
> > 
> > On July 9, 2016 5:33:05 AM GMT+08:00, Roger Light <roger at atchoo.org
> > > wrote:
> > >Hi,
> > >
> > >libwebsockets.h says:
> > >
> > >    short max_http_header_data;
> > >    /**< CONTEXT: The max amount of header payload that can be
> > handled
> > >     * in an http request (unrecognized header payload is dropped)
> > */
> > >
> > >It's not completely clear to me, does this mean the total header
> > >payload data or the payload data for each individual header entry?
> > 
> > It's the total content of all recognized headers
> > 
> > https://github.com/warmcat/libwebsockets/blob/master/lib/lextable-s
> > trings.h
> > 
> > for one http connection... they are all processed at once in an ah
> > (allocated headers struct) and then made available in callbacks
> > like ESTABLISHED and then destroyed afterwards.  Unrecognized
> > header content is just dropped.
> > 
> > Http headers have an intentional, standardized quirk that the same
> > header appearing multiple times is defined to append to a single
> > logical header, not be n instances of the header.  So to avoid
> > header fragmentation attacks, lws apis for header access
> > automatically combine originally fragmented headers and return them
> > as one; to do that they need all the headers at once.
> > 
> > It used to make sense to keep this number low by default, because
> > every http connection would malloc an ah including this buffer, if
> > a lot came at once it could blow up the memory usage unpredictably,
> > briefly.  But the change to having an ah pool, where the user can
> > control both the max_http_header_data (currently defaults to 1024)
> > and the number of pool members (currently defaults to 16), means
> > the default should probably be bigger now since it seems people are
> > bumping into it.
> > 
> > -Andy
> > 
> > >Cheers,
> > >
> > >Roger
> > >_______________________________________________
> > >Libwebsockets mailing list
> > >Libwebsockets at ml.libwebsockets.org
> > >http://libwebsockets.org/mailman/listinfo/libwebsockets
> > 
> > 



More information about the Libwebsockets mailing list