HTTP persistent connections should not be assumed for HTTP/1.0 #935
Description
Function getPipelineMax in http.lua analyzes headers from a previously obtained HTTP response and attempts to guess how many HTTP requests can be batched together.
In particular, it assumes that persistent connections are available unless header Connection is set to close.
This is an oversimplification with respect to HTTP/1.0. See RFC 7230, section 6.3 for compliant behavior.
The following patch improves getPipelineMax by assuming that persistent connections are not available if the target response is HTTP/1.0 while missing the keep-alive connection option.
--- a/nselib/http.lua
+++ b/nselib/http.lua
@@ -872,7 +872,7 @@
-- If the value is not available, an arbitrary value is used. If the connection
-- is not explicitly closed by the server, this same value is attempted.
--
--- @param response The http response - Might be a table or a raw response
+-- @param response The HTTP response table
-- @return The max number of requests on a keep-alive connection
local function getPipelineMax(response)
-- Allow users to override this with a script-arg
@@ -883,16 +883,11 @@
end
if response then
- if response.header and response.header.connection ~= "close" then
- if response.header["keep-alive"] then
- local max = string.match( response.header["keep-alive"], "max=(%d*)")
- if(max == nil) then
- return 40
- end
- return tonumber(max)
- else
- return 40
- end
+ local hdr = response.header or {}
+ local opts = stdnse.strsplit("%s+", (hdr.connection or ""):lower())
+ if stdnse.contains(opts, "close") then return 1 end
+ if response.version >= "1.1" or stdnse.contains(opts, "keep-alive") then
+ return tonumber((hdr["keep-alive"] or ""):match("max=(%d+)")) or 40
end
end
return 1Note that this patch has a dependency on proposal #934.
Please let me know if you have any questions or concerns. Otherwise I will commit the patch in a few weeks.