Mailing List Archive: Re: DoS with mod

Mailing List Archive: Apache: Dev
Re: DoS with mod_deflate & range requests

Index | Next | Previous | View Flat

ames.greg at gmail

Aug 24, 2011, 1:39 PM

Views: 3059
Permalink

Re: DoS with mod_deflate & range requests [In reply to]

On Wed, Aug 24, 2011 at 3:19 PM, Jim Jagielski <jim [at] jagunet> wrote:

>
> >
> > If we only merge adjacent ascending ranges, then it seems like an
> attacker could just craft a header where the ranges jump around and dodge
> our fix.
> >
>
> I think no matter what, we should still have some sort of
> upper limit on the number of range-sets we accept… after all,
> merge doesn't prevent jumping around ;)
>
>
The problem I have with the upper limit on the number of range sets is the
use case someone posted for JPEG2000 streaming. That has a lot of range
sets but is completely legit. However, the ranges are in ascending order
and don't overlap. Maybe we could count overlaps and/or non-ascending order
ranges and fall back to 200 + the whole object if it exceeds a limit.

Greg

Subject	User	Time
DoS with mod_deflate & range requests	sf at sfritsch	Aug 23, 2011, 4:08 AM
RE: DoS with mod_deflate & range requests	ruediger.pluem at vodafone	Aug 23, 2011, 5:11 AM
Re: DoS with mod_deflate & range requests	lazy404 at gmail	Aug 23, 2011, 5:15 AM
Re: DoS with mod_deflate & range requests	lazy404 at gmail	Aug 23, 2011, 6:56 AM
Re: DoS with mod_deflate & range requests	isoma at jellybaby	Aug 23, 2011, 7:00 AM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 23, 2011, 11:18 AM
Re: DoS with mod_deflate & range requests	sf at sfritsch	Aug 23, 2011, 11:49 AM
Re: DoS with mod_deflate & range requests	mohameddawaina at gmail	Aug 23, 2011, 11:52 AM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 23, 2011, 12:32 PM
Re: DoS with mod_deflate & range requests	ames.greg at gmail	Aug 23, 2011, 2:00 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 23, 2011, 2:34 PM
Re: DoS with mod_deflate & range requests	sf at sfritsch	Aug 23, 2011, 3:28 PM
RE: DoS with mod_deflate & range requests	ruediger.pluem at vodafone	Aug 24, 2011, 1:05 AM
Re: DoS with mod_deflate & range requests	fielding at gbiv	Aug 23, 2011, 6:34 PM
Re: DoS with mod_deflate & range requests	sf at sfritsch	Aug 23, 2011, 11:38 PM
Re: DoS with mod_deflate & range requests	isoma at jellybaby	Aug 24, 2011, 8:35 AM
Re: DoS with mod_deflate & range requests	Dirk-Willem.van.Gulik at bbc	Aug 24, 2011, 8:46 AM
RE: DoS with mod_deflate & range requests	ruediger.pluem at vodafone	Aug 24, 2011, 8:55 AM
Re: DoS with mod_deflate & range requests	fielding at gbiv	Aug 24, 2011, 1:56 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 2:12 PM
Re: DoS with mod_deflate & range requests	fielding at gbiv	Aug 24, 2011, 2:54 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 4:39 PM
Re: DoS with mod_deflate & range requests	fielding at gbiv	Aug 24, 2011, 4:43 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 4:50 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 6:01 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 5:59 PM
Re: DoS with mod_deflate & range requests	sf at sfritsch	Aug 24, 2011, 11:21 PM
RE: DoS with mod_deflate & range requests	ruediger.pluem at vodafone	Aug 24, 2011, 11:56 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 8:41 AM
Re: DoS with mod_deflate & range requests	h.reindl at thelounge	Aug 23, 2011, 3:12 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 8:48 AM
RE: DoS with mod_deflate & range requests	ruediger.pluem at vodafone	Aug 24, 2011, 9:02 AM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 9:01 AM
RE: DoS with mod_deflate & range requests	ruediger.pluem at vodafone	Aug 24, 2011, 9:05 AM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 9:22 AM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 9:42 AM
Re: DoS with mod_deflate & range requests	ames.greg at gmail	Aug 24, 2011, 12:10 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 12:34 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 1:12 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 2:01 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 9:33 AM
Re: DoS with mod_deflate & range requests	sf at sfritsch	Aug 24, 2011, 9:47 AM
Re: DoS with mod_deflate & range requests	isoma at jellybaby	Aug 24, 2011, 11:43 AM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 12:13 PM
Re: DoS with mod_deflate & range requests	isoma at jellybaby	Aug 24, 2011, 1:37 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 12:19 PM
Re: DoS with mod_deflate & range requests	ames.greg at gmail	Aug 24, 2011, 1:39 PM
Re: DoS with mod_deflate & range requests	dirkx at webweaving	Aug 24, 2011, 1:45 PM
Re: DoS with mod_deflate & range requests	fielding at gbiv	Aug 24, 2011, 1:58 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 2:00 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 2:08 PM
Re: DoS with mod_deflate & range requests	sf at sfritsch	Aug 24, 2011, 2:04 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 24, 2011, 2:06 PM
Re: DoS with mod_deflate & range requests	wrowe at rowe-clan	Aug 24, 2011, 2:19 PM
Re: DoS with mod_deflate & range requests	ames.greg at gmail	Aug 24, 2011, 2:32 PM
Re: DoS with mod_deflate & range requests	jim at jaguNET	Aug 25, 2011, 4:41 AM

Index | Next | Previous | View Flat

Interested in having your list archived? Contact Gossamer Threads