You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficserver.apache.org by "Zhao Yongming (Created) (JIRA)" <ji...@apache.org> on 2011/11/24 01:54:41 UTC
[jira] [Created] (TS-1030) hash collation in hdrtoken_hash
hash collation in hdrtoken_hash
-------------------------------
Key: TS-1030
URL: https://issues.apache.org/jira/browse/TS-1030
Project: Traffic Server
Issue Type: Bug
Components: HTTP
Affects Versions: 3.0.1, 3.1.2
Reporter: Zhao Yongming
Priority: Critical
we have find out a 3 characters collation:
SPX == PUT
that will crash TS, we need to take more care of those hash, or bad guys may put some magic headers and crash all TS in your production, that is the most powerful DOS
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (TS-1030) hash collation in hdrtoken_hash
Posted by "Leif Hedstrom (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1030?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Leif Hedstrom updated TS-1030:
------------------------------
Fix Version/s: 3.1.2
Assignee: Leif Hedstrom
> hash collation in hdrtoken_hash
> -------------------------------
>
> Key: TS-1030
> URL: https://issues.apache.org/jira/browse/TS-1030
> Project: Traffic Server
> Issue Type: Bug
> Components: HTTP
> Affects Versions: 3.1.2, 3.0.1
> Reporter: Zhao Yongming
> Assignee: Leif Hedstrom
> Priority: Critical
> Fix For: 3.1.2
>
>
> we have find out a 3 characters collation:
> SPX == PUT
> that will crash TS, we need to take more care of those hash, or bad guys may put some magic headers and crash all TS in your production, that is the most powerful DOS
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Resolved] (TS-1030) hash collation in hdrtoken_hash
Posted by "Igor Galić (Resolved JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1030?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Igor Galić resolved TS-1030.
----------------------------
Resolution: Fixed
> hash collation in hdrtoken_hash
> -------------------------------
>
> Key: TS-1030
> URL: https://issues.apache.org/jira/browse/TS-1030
> Project: Traffic Server
> Issue Type: Bug
> Components: HTTP
> Affects Versions: 3.1.2, 3.0.1
> Reporter: Zhao Yongming
> Assignee: Leif Hedstrom
> Priority: Critical
> Fix For: 3.1.2, 3.0.2
>
>
> we have find out a 3 characters collation:
> SPX == PUT
> that will crash TS, we need to take more care of those hash, or bad guys may put some magic headers and crash all TS in your production, that is the most powerful DOS
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (TS-1030) hash collation in hdrtoken_hash
Posted by "Igor Galić (Commented JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1030?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13161640#comment-13161640 ]
Igor Galić commented on TS-1030:
--------------------------------
How, exactly, do I repro this?
> hash collation in hdrtoken_hash
> -------------------------------
>
> Key: TS-1030
> URL: https://issues.apache.org/jira/browse/TS-1030
> Project: Traffic Server
> Issue Type: Bug
> Components: HTTP
> Affects Versions: 3.1.2, 3.0.1
> Reporter: Zhao Yongming
> Assignee: Leif Hedstrom
> Priority: Critical
> Fix For: 3.1.2, 3.0.2
>
>
> we have find out a 3 characters collation:
> SPX == PUT
> that will crash TS, we need to take more care of those hash, or bad guys may put some magic headers and crash all TS in your production, that is the most powerful DOS
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (TS-1030) hash collation in hdrtoken_hash
Posted by "weijin (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1030?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13156480#comment-13156480 ]
weijin commented on TS-1030:
----------------------------
the function hdrtoken_tokenize should check the content of string equality rather than just check the hash and string length. Maybe someone can give us a perfect hash for it.
@Leif, @John
> hash collation in hdrtoken_hash
> -------------------------------
>
> Key: TS-1030
> URL: https://issues.apache.org/jira/browse/TS-1030
> Project: Traffic Server
> Issue Type: Bug
> Components: HTTP
> Affects Versions: 3.1.2, 3.0.1
> Reporter: Zhao Yongming
> Priority: Critical
>
> we have find out a 3 characters collation:
> SPX == PUT
> that will crash TS, we need to take more care of those hash, or bad guys may put some magic headers and crash all TS in your production, that is the most powerful DOS
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (TS-1030) hash collation in hdrtoken_hash
Posted by "Leif Hedstrom (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1030?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Leif Hedstrom updated TS-1030:
------------------------------
Fix Version/s: 3.0.2
> hash collation in hdrtoken_hash
> -------------------------------
>
> Key: TS-1030
> URL: https://issues.apache.org/jira/browse/TS-1030
> Project: Traffic Server
> Issue Type: Bug
> Components: HTTP
> Affects Versions: 3.1.2, 3.0.1
> Reporter: Zhao Yongming
> Assignee: Leif Hedstrom
> Priority: Critical
> Fix For: 3.1.2, 3.0.2
>
>
> we have find out a 3 characters collation:
> SPX == PUT
> that will crash TS, we need to take more care of those hash, or bad guys may put some magic headers and crash all TS in your production, that is the most powerful DOS
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira