Re: Hash Table Collisions (n.runs-SA-2011.004)

[Petite Abeille <petite.abeille@...>]

On Jan 3, 2012, at 10:30 PM, Ashwin Hirschi wrote:

> If it does not, it risks being deemed not suitable for writing software for the web. I don't know about you, but I for one would not like to see that happen.

Bah...

In the meantime, feel free  to break Nanoki, which sports an HTTP server implemented in pure Lua.

The HTTP implementation doesn't impose any limit of any kind and will happily attempt to process anything you throw at it [sic].

Relevant code:

http://dev.alt.textdrive.com/browser/HTTP/HTTP.lua#L103
http://dev.alt.textdrive.com/browser/HTTP/HTTP.lua#L219

Perhaps the easiest way would be to generate a simple HTTP request with a bunch of bogus headers hashing to the same as shown by Xavier Wang somewhere else in this thread.

Nanoki's about page is as good as any to use as a guinea pig:

http://svr225.stepx.com:3388/a

The demo runs under the following setup, on a rather feeble piece of hardware:

exec bin/tcpserver -c 100 -qRHlOD 0 3388 bin/timelimit 60 bin/lua Nanoki.lua .

In other words, at most 100 connections (tcpserver [1]), for at most 60 seconds each (timelimit [2]).

The above page takes around 100ms to retrieve from my current network location. Lets us know once you managed to degrade the response time to 59 seconds using the aforementioned technique :)

[1] http://cr.yp.to/ucspi-tcp/tcpserver.html
[2] http://devel.ringlet.net/sysutils/timelimit/