Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: local policy)
From: Stefan Fritsch <sf@sfritsch.de>
To: dev@httpd.apache.org
Subject: Re: DoS with mod_deflate & range requests
Date: Wed, 24 Aug 2011 18:47:52 +0200
User-Agent: KMail/1.13.7 (Linux/3.0.0-1-amd64; KDE/4.6.5; x86_64; ; )
References: <alpine.DEB.2.00.1108231306230.24177@eru.sfritsch.de>
 <E563FB5AB3F02844AC749BA39E494AB4052FBF83@VF-MBX11.internal.vodafone.com>
 <CBAC8A2E-6171-41CF-8D7C-144CB3AB882B@jaguNET.com>
In-Reply-To: <CBAC8A2E-6171-41CF-8D7C-144CB3AB882B@jaguNET.com>
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="windows-1252"
Content-Transfer-Encoding: quoted-printable
Message-Id: <201108241847.52860.sf@sfritsch.de>

On Wednesday 24 August 2011, Jim Jagielski wrote:
> On Aug 24, 2011, at 12:05 PM, Pl=FCm, R=FCdiger, VF-Group wrote:
> >> -----Original Message-----
> >> From: Jim Jagielski [mailto:jim@jaguNET.com]
> >> Sent: Mittwoch, 24. August 2011 18:02
> >> To: dev@httpd.apache.org
> >> Subject: Re: DoS with mod_deflate & range requests
> >>=20
> >> Sorting isn't allowed but I get the impression that merging is
> >> OK... Roy can confirm...
> >=20
> > But merging might require sorting...
>=20
> then we don't do that merge, imo=85 In other words, we
> progress thru the set of ranges and once a range
> is merged as far as it can be (due to the next range
> not being merge-able with the previous one), we let
> it go...

We could also use a two stage approach: Up to some limit (e.g. 50)=20
ranges, we return them as the client requested them. Over that limit,=20
we violate the RFC-SHOULD and sort and merge them.