Login | Register For Free | Help	Search this list this category for: (Advanced)

Mailing List Archive: Apache: Dev Re: DoS with mod_deflate & range requests   Index | Next | Previous | View Flat

wrowe at rowe-clan Aug 24, 2011, 9:22 AM Views: 14569 Permalink Re: DoS with mod_deflate & range requests [In reply to] On 8/24/2011 10:55 AM, "Plüm, Rüdiger, VF-Group" wrote: > > Hm. If I got it right what Roy says above about the spec sorting and merging is > not an option as we need to stick to the order and number of ranges the client > requested. No. Merging -is- recommended. 10.4.17 416 Requested Range Not Satisfiable A server SHOULD return a response with this status code if a request included a Range request-header field (section 14.35), and none of the range-specifier values in this field overlap the current extent of the selected resource, and the request did not include an If-Range request-header field. (For byte-ranges, this means that the first- byte-pos of all of the byte-range-spec values were greater than the current length of the selected resource.) Note; the FIRST byte-pos is invalid. It doesn't suggest that 416 can be used for semantically valid ranges longer than the document length, or to represent that valid byte ranges overlapped. In fact, if ONE range can be satisfied, 416 is not appropriate. So if ONE range can be satisfied, it is to be returned (this is reiterated in 14.16), which may obviously be out-of-sequence. I would suggest we simply ignore/extend for all overlapping ranges rather than rejecting them. E.g. 0-, 40-50 becomes 0- 0-499, 400-599 becomes 0-599 1000-1075, 200-250, 1051-1100 becomes 1000-1100, 200-250 -Sorting- is to be avoided, although as its a SHOULD, I am happy to break that recommendation if there is no reasonably efficient solution to the server side. As Roy suggests, random access on the server side is very dubious. A client issuing rich requests should assemble them and must respect the individual Content-Range response headers.

Subject User Time DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 4:08 AM     RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 23, 2011, 5:11 AM     Re: DoS with mod_deflate & range requests lazy404 at gmail Aug 23, 2011, 5:15 AM     Re: DoS with mod_deflate & range requests lazy404 at gmail Aug 23, 2011, 6:56 AM     Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 23, 2011, 7:00 AM     Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 23, 2011, 11:18 AM         Re: DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 11:49 AM             Re: DoS with mod_deflate & range requests mohameddawaina at gmail Aug 23, 2011, 11:52 AM             Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 23, 2011, 12:32 PM                 Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 23, 2011, 2:00 PM     Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 23, 2011, 2:34 PM         Re: DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 3:28 PM             RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 1:05 AM         Re: DoS with mod_deflate & range requests fielding at gbiv Aug 23, 2011, 6:34 PM             Re: DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 11:38 PM             Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 24, 2011, 8:35 AM                 Re: DoS with mod_deflate & range requests Dirk-Willem.van.Gulik at bbc Aug 24, 2011, 8:46 AM                     RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 8:55 AM                 Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 1:56 PM                     Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:12 PM                     Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 2:54 PM                         Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 4:39 PM                             Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 4:43 PM                                 Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 4:50 PM                         Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 6:01 PM                     Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 5:59 PM                         Re: DoS with mod_deflate & range requests sf at sfritsch Aug 24, 2011, 11:21 PM                             RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 11:56 PM             Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 8:41 AM     Re: DoS with mod_deflate & range requests h.reindl at thelounge Aug 23, 2011, 3:12 PM     Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 8:48 AM         RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 9:02 AM     Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 9:01 AM         RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 9:05 AM     Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 9:22 AM         Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 9:42 AM             Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 24, 2011, 12:10 PM             Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 12:34 PM                 Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 1:12 PM                     Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:01 PM     Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 9:33 AM         Re: DoS with mod_deflate & range requests sf at sfritsch Aug 24, 2011, 9:47 AM             Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 24, 2011, 11:43 AM                 Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 12:13 PM                     Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 24, 2011, 1:37 PM     Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 12:19 PM         Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 24, 2011, 1:39 PM     Re: DoS with mod_deflate & range requests dirkx at webweaving Aug 24, 2011, 1:45 PM     Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 1:58 PM     Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:00 PM         Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 2:08 PM     Re: DoS with mod_deflate & range requests sf at sfritsch Aug 24, 2011, 2:04 PM     Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 2:06 PM         Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:19 PM         Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 24, 2011, 2:32 PM     Re: DoS with mod_deflate & range requests jim at jaguNET Aug 25, 2011, 4:41 AM

Index | Next | Previous | View Flat   Apache     Announce     Users     Dev     Bugs     CVS     Docs

Interested in having your list archived? Contact Gossamer Threads
 

Web Applications & Managed Hosting Powered by Gossamer Threads Inc.