Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Apache: Dev
Re: DoS with mod_deflate & range requests 		 

Index | Next | Previous | View Flat


sf at sfritsch

Aug 23, 2011, 11:49 AM


Views: 14558
Permalink
Re: DoS with mod_deflate & range requests [In reply to]
On Tuesday 23 August 2011, William A. Rowe Jr. wrote:
> On 8/23/2011 6:08 AM, Stefan Fritsch wrote:
> > http://seclists.org/fulldisclosure/2011/Aug/175
> >
> > I haven't looked into it so far. And I am not sure I will have
> > time today.
>
> Until range can be completely addressed, avoiding excessive numbers
> of ranges (tricky) or overlapping ranges (pretty
> straightforward)... what about simply disabling deflate on range
> requests?

There is this PR:

https://issues.apache.org/bugzilla/show_bug.cgi?id=49772

"mod_deflate kicks itself out on Content-Range responses but not on
multipart/byteranges"

This may be one of the issues. But as Rüdiger pointed out, there is
also an issue without mod_deflate.

From looking at the code, I think the problem is the bucket structs.
With N the number of requested ranges, the initial brigade is
partitioned into 2*N buckets at the maximum. Then those buckets are
copied into the output brigade N times, which means that O(N^2)
buckets are created. The data is not copied, and only N "A-B" strings
are allocated from the pool. But the sum of those is limited by
LimitRequestFieldSize, so it shouldn't be a problem.

Maybe the byte-range filter should call ap_pass_brigade every 10
ranges or so? Then the buckets should be freed earlier (at least if
all filters down the chain behave correctly).

Subject User Time
DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 4:08 AM
    RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 23, 2011, 5:11 AM
    Re: DoS with mod_deflate & range requests lazy404 at gmail Aug 23, 2011, 5:15 AM
    Re: DoS with mod_deflate & range requests lazy404 at gmail Aug 23, 2011, 6:56 AM
    Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 23, 2011, 7:00 AM
    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 23, 2011, 11:18 AM
        Re: DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 11:49 AM
            Re: DoS with mod_deflate & range requests mohameddawaina at gmail Aug 23, 2011, 11:52 AM
            Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 23, 2011, 12:32 PM
                Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 23, 2011, 2:00 PM
    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 23, 2011, 2:34 PM
        Re: DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 3:28 PM
            RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 1:05 AM
        Re: DoS with mod_deflate & range requests fielding at gbiv Aug 23, 2011, 6:34 PM
            Re: DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 11:38 PM
            Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 24, 2011, 8:35 AM
                Re: DoS with mod_deflate & range requests Dirk-Willem.van.Gulik at bbc Aug 24, 2011, 8:46 AM
                    RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 8:55 AM
                Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 1:56 PM
                    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:12 PM
                    Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 2:54 PM
                        Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 4:39 PM
                            Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 4:43 PM
                                Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 4:50 PM
                        Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 6:01 PM
                    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 5:59 PM
                        Re: DoS with mod_deflate & range requests sf at sfritsch Aug 24, 2011, 11:21 PM
                            RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 11:56 PM
            Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 8:41 AM
    Re: DoS with mod_deflate & range requests h.reindl at thelounge Aug 23, 2011, 3:12 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 8:48 AM
        RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 9:02 AM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 9:01 AM
        RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 9:05 AM
    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 9:22 AM
        Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 9:42 AM
            Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 24, 2011, 12:10 PM
            Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 12:34 PM
                Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 1:12 PM
                    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:01 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 9:33 AM
        Re: DoS with mod_deflate & range requests sf at sfritsch Aug 24, 2011, 9:47 AM
            Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 24, 2011, 11:43 AM
                Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 12:13 PM
                    Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 24, 2011, 1:37 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 12:19 PM
        Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 24, 2011, 1:39 PM
    Re: DoS with mod_deflate & range requests dirkx at webweaving Aug 24, 2011, 1:45 PM
    Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 1:58 PM
    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:00 PM
        Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 2:08 PM
    Re: DoS with mod_deflate & range requests sf at sfritsch Aug 24, 2011, 2:04 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 2:06 PM
        Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:19 PM
        Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 24, 2011, 2:32 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 25, 2011, 4:41 AM

  Index | Next | Previous | View Flat
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.