The limit specified by body_max_count is not really the maximum that is allowed

[agentzh]

People tend to think the limit specified by body_max_count is the maximum that is allowed. But one cannot actually achieve that number. For example, if we have

body_max_count 3;

then only 2 query args are accepted. It makes sense to accept 3 args but reject more. The following patch fixes this:

diff --git a/ngx_hashdos_module.c b/ngx_hashdos_module.c
index 535b993..d3466a6 100644
--- a/ngx_hashdos_module.c
+++ b/ngx_hashdos_module.c
@@ -227,7 +227,7 @@ ngx_hashdos_request_body_handler(ngx_http_request_t *r)
     }
     ++count;
     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,"[hashdos] parse     request body params count is .... %O, limit is %O", count, limit);
-    if(count >= limit){
+    if(count > limit){
         (void) ngx_http_discard_request_body(r);
         ngx_http_finalize_request(r, NGX_HTTP_REQUEST_ENTITY_TOO_LARGE);    
         ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,

[agentzh]

Sorry, Test::Nginx::Socket has just caught the real issue here, your current implementation does not quit the main request processing flow properly (calling ngx_http_finalize_request is not the right thing to do in the post_read handler).

Below is my patch for your module that makes this module pass my tests with Test::Nginx::Socket + mockeagain + etcproxy + valgrind:

http://agentzh.org/misc/nginx/ngx_hashdos_module.patch

In case you're interested, here's the test script that I'm using: http://agentzh.org/misc/nginx/hashdos.t very naive tests but also very useful already :)

Hope this helps,
-agentzh