3 messages in ru.sysoev.nginxPossible DoS in nginx 0.5.31 with aut...
FromSent OnAttachments
areq...@public.gmane.orgSep 22, 2007 10:15 am 
Igor SysoevSep 22, 2007 10:41 am.txt
Arkadiusz PatykSep 22, 2007 11:01 am 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:Possible DoS in nginx 0.5.31 with autoindex on;Actions...
From:areq...@public.gmane.org (areq@public.gmane.org)
Date:Sep 22, 2007 10:15:03 am
List:ru.sysoev.nginx

Hi

server { listen 10.9.31.6:80; server_name pld.areq.eu.org; access_log /var/log/nginx//pld.access.log; location / { root /vol/mirror/ftp.pld-linux.org; autoindex on; } }

# ls /vol/mirror/ftp.pld-linux.org dists

After few hours nginx return 500 error page and log too many open files.

I discovered than nginx don't close opened directory after HEAD:

echo -e "HEAD / HTTP/1.1\r\nHost: pld.areq.eu.org\r\n\r\n" | nc 10.9.31.6 80 lsof: nginx 10066 nginx 21r DIR 9,0 18 402653312 /vol/mirror/ftp.pld-linux.org nginx 10066 nginx 22r DIR 9,0 18 402653312 /vol/mirror/ftp.pld-linux.org

each HEAD on dir increase number of opened files.

strace: epoll_wait(20, {{EPOLLIN, {u32=135133300, u64=4430100596}}}, 512, -1) = 1 gettimeofday({1190147846, 304732}, NULL) = 0 accept(16, {sa_family=AF_INET, sin_port=htons(1581), sin_addr=inet_addr("10.9.8.100")}, [16]) = 18 ioctl(18, FIONBIO, [1]) = 0 epoll_ctl(20, EPOLL_CTL_ADD, 18, {EPOLLIN|EPOLLET, {u32=135133552, u64=13807009823030376816}}) = 0 epoll_wait(20, {{EPOLLIN, {u32=135133552, u64=13807009823030376816}}}, 512, 60000) = 1 gettimeofday({1190147846, 305917}, NULL) = 0 recv(18, "HEAD / HTTP/1.1\r\nHost: pld.areq"..., 1024, 0) = 42 open("/vol/mirror/ftp.pld-linux.org/index.html", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) stat64("/vol/mirror/ftp.pld-linux.org", {st_mode=S_IFDIR|0755, st_size=18, ...}) = 0 open("/vol/mirror/ftp.pld-linux.org", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 25 fstat64(25, {st_mode=S_IFDIR|0755, st_size=18, ...}) = 0 fcntl64(25, F_SETFD, FD_CLOEXEC) = 0 writev(18, [{"HTTP/1.1 200 OK\r\nServer: nginx/0"..., 155}], 1) = 155 write(7, "10.9.8.100 - - [18/Sep/2007:22:3"..., 76) = 76 recv(18, "", 982, 0) = 0 write(7, "10.9.8.100 - - [18/Sep/2007:22:3"..., 62) = 62 close(18) = 0 epoll_wait(20,

Cheers, Arek