Bugtraq mailing list archives

Re: IE4 Persistent Connection Bug


From: dolske () reston wcom net (Justin Dolske)
Date: Mon, 25 Jan 1999 16:53:30 -0500


On Mon, 25 Jan 1999, Drazen Kacar wrote:

     The browser will display "abcde," and the IE logo will stop
     circulating. However, the connection will not -- as requested by the
     server -- close. If you issue another page request in the browser for

You mean "as requested by the origin server." Connection header is hop-by-hop,
which means that it has a meaning for a connection between origin server
and proxy server only.

I included this in my original example just to clarify that MIE shouldn't
be attempting to make a persistant connection "through" the proxy. This
header is not needed to cause the behaviour in question, however.

It doesn't. Your netcat "proxy" violates it. Here's a quote from RFC 1945:

  Except for experimental applications, current practice requires that
  the connection be established by the client prior to each request and
  closed by the server after sending the response.

Yes, but that doesn't address what the client should do if it wants to
send a second request but the connection has not yet closed. Consider that
network latency may result in the server's/proxy's FIN being delayed --
the client would still send the request, even though the connection is
being closed. From the client's point-of-view, it can't tell the
difference between a delayed close and netcat not closing the connection
at all.

The point is not who should be closing the connection, but that MIE is
sending a second request over a connection that has not been negotiated to
be persistant.

Justin Dolske   (dolske () reston wcom net)
MCI WorldCom Advanced Networks                 Interlock Firewall Development


-=-=-=-=-=-=-=-=-=-=-=-=-=- Random Sig-o-Matic (tm) -=-=-=-=-=-=-=-=-=-=-=-=-
Windows 95: n.
 32 bit extensions and a graphical shell for a 16 bit patch to an
 8 bit operating system originally coded for a 4 bit microprocessor,
 written by a 2 bit company, that can't stand 1 bit of competition.



Current thread: