Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Message-ID: <4B0EEDF0.1070902@apache.org>
Date: Thu, 26 Nov 2009 22:06:56 +0100
From: Ruediger Pluem <rpluem@apache.org>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US;
 rv:1.8.1.23) Gecko/20090823 SeaMonkey/1.1.18
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: handling request splicing in case of server
 initiated	renegotiation
 CVE-2009-3555
References: <4B01BD20.1060300@adnovum.ch> <20091116221903.GB18036@redhat.com>
 <4B027E20.2030200@adnovum.ch> <20091117130812.GB29064@redhat.com>
 <4B02D989.1070604@adnovum.ch> <20091119093041.GA9262@redhat.com>
 <4B055EBE.5090307@adnovum.ch> <20091119155854.GA25109@redhat.com>
In-Reply-To: <20091119155854.GA25109@redhat.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit


On 11/19/2009 04:58 PM, Joe Orton wrote:
> On Thu, Nov 19, 2009 at 04:05:34PM +0100, Hartmut Keil wrote:
>> With the proposed change, we prevent request splitting attacks based 
>> on the TSL renegotiation flaw. From my point of view without 
>> drawbacks, since 'pipelining' clients must handle the closing of a 
>> connection after a complete response in any case.
> 
> Yes, I agree, this seems very sensible, I can't see any problem with 
> this.  
> 
> I would prefer to do it in a slightly more general way as below, which 
> would catch the case where any other module's connection filter had 
> buffered the data, and adds appropriate logging.
> 
> (more general but which required half a day tracking down an obscure bug 
> in the BIO/filters, also fixed below...)
> 
> Testing on this version very welcome!

Anything that prevents this from committing?

Regards

Rüdiger