You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Jim Jagielski <ji...@jaguNET.com> on 2004/03/18 22:35:45 UTC

fix_hostname() in 1.3.30-dev broken

Ugg... fix_hostname() in 1.3.30-dev (and previous) are
broken such that it does *not* update parsed_uri with
the port and port_str value from the Host header.
This means that with a request like:

     % telnet localhost 8888
     GET / HTTP/1.1
     Host: foo:9999

that the '9999' port value from the Host header is
ignored! 2.0 handles this correctly. This implies
also that UseCanonicalName Off is still broken, since
it's ignoring the port provided in the Host header.
So we correctly adjust r->hostname but not port_str/port


Re: fix_hostname() in 1.3.30-dev broken

Posted by "Roy T. Fielding" <fi...@gbiv.com>.
> Ugg... fix_hostname() in 1.3.30-dev (and previous) are
> broken such that it does *not* update parsed_uri with
> the port and port_str value from the Host header.
> This means that with a request like:
>
>     % telnet localhost 8888
>     GET / HTTP/1.1
>     Host: foo:9999
>
> that the '9999' port value from the Host header is
> ignored!

When is fix_hostname() used?  If it is used anywhere other than
ProxyPass redirects, then it must ignore that port value.  To do
otherwise would introduce a security hole in servers that rely on
port blocking at firewalls.  I agree that ProxyPass needs to
know that port number, but that should be handled within the
proxy itself.

....Roy