You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Jim Jagielski <ji...@jaguNET.com> on 2004/03/18 22:35:45 UTC
fix_hostname() in 1.3.30-dev broken
Ugg... fix_hostname() in 1.3.30-dev (and previous) are
broken such that it does *not* update parsed_uri with
the port and port_str value from the Host header.
This means that with a request like:
% telnet localhost 8888
GET / HTTP/1.1
Host: foo:9999
that the '9999' port value from the Host header is
ignored! 2.0 handles this correctly. This implies
also that UseCanonicalName Off is still broken, since
it's ignoring the port provided in the Host header.
So we correctly adjust r->hostname but not port_str/port
Re: fix_hostname() in 1.3.30-dev broken
Posted by "Roy T. Fielding" <fi...@gbiv.com>.
> Ugg... fix_hostname() in 1.3.30-dev (and previous) are
> broken such that it does *not* update parsed_uri with
> the port and port_str value from the Host header.
> This means that with a request like:
>
> % telnet localhost 8888
> GET / HTTP/1.1
> Host: foo:9999
>
> that the '9999' port value from the Host header is
> ignored!
When is fix_hostname() used? If it is used anywhere other than
ProxyPass redirects, then it must ignore that port value. To do
otherwise would introduce a security hole in servers that rely on
port blocking at firewalls. I agree that ProxyPass needs to
know that port number, but that should be handled within the
proxy itself.
....Roy