I have a problem that seems to manifest itself only on Mac OSX, and only on the Firefox browser (granted, I’ve only tried Safari and Chrome besides Firefox).
The problem is that file uploads seem to not work properly for Firefox on OSX. Only authenticated users are allowed to upload files, and all authenticated users run under SSL.
The server is Apache2, running on Ubuntu server:
Linux www1 2.6.32-24-server #39-Ubuntu SMP Wed Jul 28 06:21:40 UTC 2010 x86_64 GNU/Linux
So, in my error-ssl.log-file, I get an entry like the following when a user tries to upload a file under these conditions:
[Sat Mar 24 12:57:53 2012] [error] [client xxx.xxx.xxx.xxx] request
failed: error reading the headers, referer: {some-page}
The corresponding request in access-ssl.log looks like the following:
xxx.xxx.xxx.xxx – – [24/Mar/2012:12:57:40 +0100] “POST /attachment/upload HTTP/1.1” 400 734
“{referer}”
“Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:11.0) Gecko/20100101 Firefox/11.0”
Now, I’m a bit stumped how I’m supposed to tackle this. I don’t have a Mac myself (though we have a few at the office, but without any developer tools installed), and for all other browsers, as well as all browsers on Windows, it seems to work just fine.
- Any ideas of what can be done?
- Could it be an SSL issue?
If you need any more information regarding the server config etc, tell me what you need and I’ll try to include it.
This is a known bug in Apache. You have not posted what version of Apache2 you’re running, but it was an issue that was patched many, many years ago with Apache 2.2.17. The bug was present from Apache 2.2.9 to 2.2.16, inclusive. Your instincts regarding both mod_ssl and Firefox are (if this is the case) very much correct.
The bug is #45444 and has to do with corruption of the request headers due to a buffer overlap/overwrite in mod_ssl. I’m 90% sure this is what you’re seeing as it only manifests in ssl requests and apparently, only ever reported with Firefox.
You’ll recognize the bug report in the RedHat bugzilla #646704, which is a duplicate of RedHat issue #624609, which in turn was tracked down to Apache bug #45444.
(Edit: If I’m not mistaken, based off your kernel version you’re running Ubuntu 10.04 Lucid, for which Apache version on the official repos is 2.2.14 and is affected by this issue. I cannot find any repos for Apache 2.2.17+ for 10.04, as it was not a LTS release; you’ll likely have to build it yourself.)