Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Apache: Dev
Re: DoS with mod_deflate & range requests
 

Index | Next | Previous | View Flat


jim at jaguNET

Aug 24, 2011, 12:13 PM


Views: 6362
Permalink
Re: DoS with mod_deflate & range requests [In reply to]

On Aug 24, 2011, at 2:43 PM, Tim Bannister wrote:

> On 24 Aug 2011, at 17:47, Stefan Fritsch wrote:
> On Wednesday 24 August 2011, Jim Jagielski wrote:
>>> On Aug 24, 2011, at 12:05 PM, Plüm, Rüdiger, VF-Group wrote:
>>>>
>>>> But merging might require sorting...
>>>
>>> then we don't do that merge, imo… In other words, we progress thru the set of ranges and once a range is merged as far as it can be (due to the next range not being merge-able with the previous one), we let it go...
>>
>> We could also use a two stage approach: Up to some limit (e.g. 50) ranges, we return them as the client requested them. Over that limit, we violate the RFC-SHOULD and sort and merge them.
>
> Another option is just to return 200. Servers MAY ignore the Range header. I prefer this because existing clients already handle that case well, and there's no opportunity for a client to exploit this (“malicious” clients that want the whole entity need only request it).
>
> Can anyone see why returning 200 for these complex requests (by ignoring Range / If-Range) is a bad idea?

In what cases would we ignore it? Dependent only on >=X ranges?
It does seem that 14.5 gives us this as an out...

Subject User Time
DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 4:08 AM
    RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 23, 2011, 5:11 AM
    Re: DoS with mod_deflate & range requests lazy404 at gmail Aug 23, 2011, 5:15 AM
    Re: DoS with mod_deflate & range requests lazy404 at gmail Aug 23, 2011, 6:56 AM
    Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 23, 2011, 7:00 AM
    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 23, 2011, 11:18 AM
        Re: DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 11:49 AM
            Re: DoS with mod_deflate & range requests mohameddawaina at gmail Aug 23, 2011, 11:52 AM
            Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 23, 2011, 12:32 PM
                Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 23, 2011, 2:00 PM
    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 23, 2011, 2:34 PM
        Re: DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 3:28 PM
            RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 1:05 AM
        Re: DoS with mod_deflate & range requests fielding at gbiv Aug 23, 2011, 6:34 PM
            Re: DoS with mod_deflate & range requests sf at sfritsch Aug 23, 2011, 11:38 PM
            Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 24, 2011, 8:35 AM
                Re: DoS with mod_deflate & range requests Dirk-Willem.van.Gulik at bbc Aug 24, 2011, 8:46 AM
                    RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 8:55 AM
                Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 1:56 PM
                    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:12 PM
                    Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 2:54 PM
                        Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 4:39 PM
                            Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 4:43 PM
                                Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 4:50 PM
                        Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 6:01 PM
                    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 5:59 PM
                        Re: DoS with mod_deflate & range requests sf at sfritsch Aug 24, 2011, 11:21 PM
                            RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 11:56 PM
            Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 8:41 AM
    Re: DoS with mod_deflate & range requests h.reindl at thelounge Aug 23, 2011, 3:12 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 8:48 AM
        RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 9:02 AM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 9:01 AM
        RE: DoS with mod_deflate & range requests ruediger.pluem at vodafone Aug 24, 2011, 9:05 AM
    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 9:22 AM
        Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 9:42 AM
            Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 24, 2011, 12:10 PM
            Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 12:34 PM
                Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 1:12 PM
                    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:01 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 9:33 AM
        Re: DoS with mod_deflate & range requests sf at sfritsch Aug 24, 2011, 9:47 AM
            Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 24, 2011, 11:43 AM
                Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 12:13 PM
                    Re: DoS with mod_deflate & range requests isoma at jellybaby Aug 24, 2011, 1:37 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 12:19 PM
        Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 24, 2011, 1:39 PM
    Re: DoS with mod_deflate & range requests dirkx at webweaving Aug 24, 2011, 1:45 PM
    Re: DoS with mod_deflate & range requests fielding at gbiv Aug 24, 2011, 1:58 PM
    Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:00 PM
        Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 2:08 PM
    Re: DoS with mod_deflate & range requests sf at sfritsch Aug 24, 2011, 2:04 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 24, 2011, 2:06 PM
        Re: DoS with mod_deflate & range requests wrowe at rowe-clan Aug 24, 2011, 2:19 PM
        Re: DoS with mod_deflate & range requests ames.greg at gmail Aug 24, 2011, 2:32 PM
    Re: DoS with mod_deflate & range requests jim at jaguNET Aug 25, 2011, 4:41 AM

  Index | Next | Previous | View Flat
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.