Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Apache: Dev
RE: DoS with mod_deflate & range requests 		 

Index | Next | Previous | View Flat


ruediger.pluem at vodafone

Aug 24, 2011, 8:55 AM


Views: 14474
Permalink
RE: DoS with mod_deflate & range requests [In reply to]
> -----Original Message-----
> From: Dirk-Willem van Gulik [mailto:Dirk-Willem.van.Gulik [at] bbc]
> Sent: Mittwoch, 24. August 2011 17:46
> To: dev [at] httpd
> Subject: Re: DoS with mod_deflate & range requests
>
>
> On 24 Aug 2011, at 16:35, Tim Bannister wrote:
>
> > On Tue, Aug 23, 2011, Roy T. Fielding wrote:
> >> And the spec says ...
> >>
> >> When a client requests multiple ranges in one request, the
> >> server SHOULD return them in the order that they appeared in the
> >> request.
> >>
> >> My suggestion is to reject any request with overlapping
> ranges or more
> >> than five ranges with a 416, and to send 200 for any
> request with 4-5
> >> ranges. There is simply no need to support random access in HTTP.
> >
> > Deshpande & Zeng in http://dx.doi.org/10.1145/500141.500197
> describe a
> > method for "streaming" JPEG 2000 documents over HTTP, using
> many more than
> > 5 ranges in a single request.
> > A client that knows about any server-side limit could make multiple
> > requests each with a small number of ranges, but
> discovering that limit
> > will add latency and take more code.
>
> Agreed - I've seen many 10's of ranges in a single request
> for things like clever PDF pagination (or tiny TIFF
> quicklooks for the pages), clever http fake streaming and
> clever use of jumping to i-Frames.
>
> I think we just need to sit this out - and accept up to
> RequestFieldSize limit bytes on that line - and then do a
> sort & merge overlaps as needed.

Hm. If I got it right what Roy says above about the spec sorting and merging is
not an option as we need to stick to the order and number of ranges the client
requested. But we can deny overlapping with a 416.
Or we do a 416 as well if merging would change something.

Regards

Rüdiger

Subject User Time
DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 4:08 AM
    RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 23, 2011, 5:11 AM
    Re: DoS with mod_deflate & range requests lazy404 at gmail Aug 23, 2011, 5:15 AM
    Re: DoS with mod_deflate & range requests lazy404 at gmail Aug 23, 2011, 6:56 AM
    Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 23, 2011, 7:00 AM
    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 23, 2011, 11:18 AM
        Re: DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 11:49 AM
            Re: DoS with mod_deflate & range requests mohameddawaina at gmail Aug 23, 2011, 11:52 AM
            Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 23, 2011, 12:32 PM
                Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 23, 2011, 2:00 PM
    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 23, 2011, 2:34 PM
        Re: DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 3:28 PM
            RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 1:05 AM
        Re: DoS with mod_deflate & range requests fielding at gbiv Aug 23, 2011, 6:34 PM
            Re: DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 11:38 PM
            Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 24, 2011, 8:35 AM
                Re: DoS with mod_deflate & range requests Dirk-Willem.van.Gulik at bbc Aug 24, 2011, 8:46 AM
                    RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 8:55 AM
                Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 1:56 PM
                    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:12 PM
                    Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 2:54 PM
                        Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 4:39 PM
                            Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 4:43 PM
                                Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 4:50 PM
                        Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 6:01 PM
                    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 5:59 PM
                        Re: DoS with mod_deflate & range requests sf at sfritsch Aug 24, 2011, 11:21 PM
                            RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 11:56 PM
            Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 8:41 AM
    Re: DoS with mod_deflate & range requests h.reindl at thelounge Aug 23, 2011, 3:12 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 8:48 AM
        RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 9:02 AM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 9:01 AM
        RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 9:05 AM
    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 9:22 AM
        Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 9:42 AM
            Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 24, 2011, 12:10 PM
            Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 12:34 PM
                Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 1:12 PM
                    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:01 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 9:33 AM
        Re: DoS with mod_deflate & range requests sf at sfritsch Aug 24, 2011, 9:47 AM
            Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 24, 2011, 11:43 AM
                Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 12:13 PM
                    Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 24, 2011, 1:37 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 12:19 PM
        Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 24, 2011, 1:39 PM
    Re: DoS with mod_deflate & range requests dirkx at webweaving Aug 24, 2011, 1:45 PM
    Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 1:58 PM
    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:00 PM
        Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 2:08 PM
    Re: DoS with mod_deflate & range requests sf at sfritsch Aug 24, 2011, 2:04 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 2:06 PM
        Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:19 PM
        Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 24, 2011, 2:32 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 25, 2011, 4:41 AM

  Index | Next | Previous | View Flat
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.