#583 check_http injecting garbage into content, breaking --string

v1.4.14
open
Holger Weiß
5
2012-12-07
2012-12-06
John Whitlock
No

Plugin Version (-V output): check_http v1.4.16-61-g1845c (nagios-plugins 1.4.16)
Plugin Name: check_http
Plugin Commandline showing issues: ./check_http -H 'www.consumeraffairs.com' -u '/' -v | head -n 20
Operating System: OS X 10.8.2, Ubuntu 12.04.1 LTS
Architecture: x86_64
Compiler: gcc 4.2.1, ubuntu package

When running check_http against our server, it appears to inject garbage (with newlines) into the content. Here's the output of my example run:

GET / HTTP/1.1
User-Agent: check_http/v1.4.16-61-g1845c (nagios-plugins 1.4.16)
Connection: close
Host: www.consumeraffairs.com

http://www.consumeraffairs.com:80/ is 30933 characters
STATUS: HTTP/1.1 200 OK
**** HEADER ****
Server: nginx/1.1.19
Vary: Cookie
Content-Type: text/html; charset=utf-8
Date: Thu, 06 Dec 2012 20:32:29 GMT
Transfer-Encoding: chunked
Connection: close
Set-Cookie: X-Mapping-fjhppofk=0F06A766EC4682365170E5AA67F0FDDA; path=/
Set-Cookie: X-Mapping-fjhppofk=0F06A766EC4682365170E5AA67F0FDDA; path=/
**** CONTENT ****
1f66
<!doctype html><!--[if lt IE 7 ]><html lang="en" class="no-js ie6"> ... (trimmed) ...

The '1f66' does not appear in the actual response, as verified with the browser, curl, wget, etc. It appears it injects something like '1000', '2000', every few thousand characters, and a final '0' at the end. I don't see these results against other hosts - ours appears to be 'lucky'. We're running on nginx in Rackspace and using their load balancer service, but it reproduces running against a webserver on my laptop.

I ran in gdb, and it looks like the calls to `while ((i = my_recv (buffer, MAX_INPUT_BUFFER-1)) > 0) {` are injecting the garbage into the buffer, so it is somewhere in the read code. Changing the buffer size or max read size appears to have no effect. valgrind finds no reads of uninitialized memory.

It was breaking expected string checks, which is why we noticed it. I'm turning off the expected string tests, so we'll just check 200 and timeouts.

Discussion

  • John Whitlock
    John Whitlock
    2012-12-06

    And also http://wordpress.com, which is an nginx site probably running PHP+Wordpress. Maybe this is an issue w/ nginx?

     
  • Graham
    Graham
    2012-12-06

    This is chunked data. Isnt the 'garbage' part of the way chunked data is transmitted? Check_http probably doesn't understand chunking.

     
  • Ferenc Wágner
    Ferenc Wágner
    2012-12-07

    Yes, this is actually #2786808: check_http asks for HTTP/1.1, but doesn't understand chunked.

     
  • Holger Weiß
    Holger Weiß
    2012-12-07

    • assigned_to: nobody --> hweiss