httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Tikka, Sami" <Sami.Ti...@F-Secure.com>
Subject Should mod_proxy abort when browser aborts?
Date Thu, 05 Dec 2002 09:35:36 GMT
Another thing I have been oogling is proxy_http.c line 946 where the HTTP
response is passed to proxy output filters:

if (ap_pass_brigade(r->output_filters, bb) != APR_SUCCESS) {
	/* Ack! Phbtt! Die! User aborted! */
      p_conn->close = 1;  /* this causes socket close below */
      finish = TRUE;
}

It seems to me that core_output_filter always returns APR_SUCCESS, even if it
detects that the socket has been closed by the browser, which means that the
proxy will happily download and send all of the HTTP response even if there
is no-one to send it to.

I am tinkering with a small proxy output filter and I'm working around the
problem like this: (code in my output filter)

rv = ap_pass_brigade(f->next, bb);
if (!APR_STATUS_IS_SUCCESS(rv) || f->c->aborted) {
	ap_log_rerror(....);
	return AP_FILTER_ERROR;
}
return rv;

Should the check for conn->aborted flag be added into proxy_http.c? I think
it should. It would of course prevent the proxy from continuing to download
into the cache after the browser has aborted, even if this was the desired
behaviour. But is that really a good feature anyway? Isn't it too easy to
overload the proxy by a malicious or ignorant user by starting to download a
big file and aborting and repeating this a few hundred times?

-- 
Sami Tikka, senior software engineer, F-Secure Corporation
tel: +358 9 2520 5115, fax: +358 9 2520 5015
http://www.F-Secure.com
F-Secure: Securing the Mobile Enterprise

Mime
View raw message