Re: Apache Firefox and Ogg Theora (Byte-range requests)

2010-02-18 Thread Атанас Владимиров
2010/2/18 Pierre-Yves Ritschard p...@spootnik.org

  This appears to be due to the format of the string being passed to
  strtonum().  ap_strtol() was tolerant of it.  It's being passed the
  string from the Range: header.
 
  For example, the following valid request (taken directly from sniffing a
  wget session).
 
   GET /testfile HTTP/1.0
   Range: bytes=300417024-
 
  This ends up following the code path of the first strtonum() call around
  line 159 in http_protocol.c in the parse_byterange() function.  The
  string passed to strtonum to convert (r-range) not only contains the
  number from the header, but the trailing dash (300417024-), which
  strtonum does not like.  As strtonum fails, the start offset is set to
  0.
 
  This bug should be present on a 64-bit arch as well.
 
 
 Hi,

 I broke it when unbreaking support for large files in Content-Length (which
 would otherwise report 0). I'll have a diff ready soon which fixes that.

  - pyr.


I'm glad to hear this :)



Re: Apache Firefox and Ogg Theora (Byte-range requests)

2010-02-17 Thread Dan Harnett
On Wed, Feb 17, 2010 at 02:04:03AM +, Stuart Henderson wrote:
 On 2010-02-16, trustlevel-...@yahoo.co.uk trustlevel-...@yahoo.co.uk wrote:
  I've seen examples of earlier versions than Apache 1.3.29 said to be working
  with byte-range requests, has anyone got the byte range requests to work 
  with
  openbsd without using php code or know how this can be done or if it works 
  by
  default.
 
 sorry, it's broken, maybe someone who uses base httpd and has some
 spare time might like to look into fixing it...
 
 http://permalink.gmane.org/gmane.os.openbsd.misc/169541
 


This appears to be due to the format of the string being passed to
strtonum().  ap_strtol() was tolerant of it.  It's being passed the
string from the Range: header.

For example, the following valid request (taken directly from sniffing a
wget session).

  GET /testfile HTTP/1.0
  Range: bytes=300417024-

This ends up following the code path of the first strtonum() call around
line 159 in http_protocol.c in the parse_byterange() function.  The
string passed to strtonum to convert (r-range) not only contains the
number from the header, but the trailing dash (300417024-), which
strtonum does not like.  As strtonum fails, the start offset is set to
0.

This bug should be present on a 64-bit arch as well.



Re: Apache Firefox and Ogg Theora (Byte-range requests)

2010-02-17 Thread Pierre-Yves Ritschard
 This appears to be due to the format of the string being passed to
 strtonum().  ap_strtol() was tolerant of it.  It's being passed the
 string from the Range: header.

 For example, the following valid request (taken directly from sniffing a
 wget session).

  GET /testfile HTTP/1.0
  Range: bytes=300417024-

 This ends up following the code path of the first strtonum() call around
 line 159 in http_protocol.c in the parse_byterange() function.  The
 string passed to strtonum to convert (r-range) not only contains the
 number from the header, but the trailing dash (300417024-), which
 strtonum does not like.  As strtonum fails, the start offset is set to
 0.

 This bug should be present on a 64-bit arch as well.


Hi,

I broke it when unbreaking support for large files in Content-Length (which
would otherwise report 0). I'll have a diff ready soon which fixes that.

  - pyr.



Apache Firefox and Ogg Theora (Byte-range requests)

2010-02-16 Thread trustlevel-two
Hi,

The Question first (may save time)

I've seen examples of earlier versions than Apache 1.3.29 said to be working
with byte-range requests, has anyone got the byte range requests to work with
openbsd without using php code or know how this can be done or if it works by
default.


The Story


I've had some problems with my web host or rather they have had problems (ssl
key stuck and ssh has been disabled for over a month now???) and so have been
creating an image for a dedicated web server with the default apache 1.3 to
give me more control and security. Everything was going well and I was about
to move onto performance testing and pf optimisation.

I then found that my .ogv video files were causing a connection loop even when
loaded via a direct url. This doesn't happen in firefox 3.1b3 but does in
firefox 3.5 alphas. In firefox 3.1b3 the seeking didn't work but the video
played. The mimetype is being provided by apache. Ogg video also works in
Opera 10.50 beta, probably because it's not fully implemented as per the w3c
recommendations yet as I would guess for firefox 3.1b3.

I've since learned via sniffing, curl and the http headers that byte-range
requests are being ignored (hence no seeking) and the whole file delivered via
a 200 response rather than the portion requested via a 206 response as works
with the same httpd.conf configuration on Linux Apache 1.3. After
investigating if any packets being dropped were the cause due to wireshark
indicating dropped packets (just wireshark I think with looped connections
(1000s of packets in seconds)) and giving the message tcp segment of a
reassembled pdu, I tried running curl on the loopback of the openbsd box and
reviewing the apache config and the source code (a little) and also network
settings but without any luck in getting byte-range requests to work.

It looks like I may have to drop support of native firefox video, something I
have great support for with the security nightmare of flash. I could also try
apache2 which I would rather not as I have read the openbsd apache is heavily
modified and audited and ports well tested and ready to go.



The Question (Again)

I've seen examples of earlier versions than Apache 1.3.29 said to be working
with byte-range requests, has anyone got the byte range requests to work with
openbsd without using php code or know how this can be done or if it works by
default.



Byte-range support can be tested with the following, if you have curl
installed and apache enabled or know of openbsd served websites.

/usr/local/bin/curl --range 3-5
http://www.openbsd1.3server.org/filelargethan5bytes  /dev/null

Output = received 3 bytes

/usr/local/bin/curl --range 5-800
http://www.openbsd1.3server.org/filelargethan800bytes  /dev/null

Output = received 796 bytes

Thanks for any help
KeV
==
After an exploit in smoothwall and a mountain of Livecd's and pdfs, an install
of netbsd and trustix, I was finally stunned by Openbsd (a real element) and
rarely look back.



Re: Apache Firefox and Ogg Theora (Byte-range requests)

2010-02-16 Thread Stuart Henderson
On 2010-02-16, trustlevel-...@yahoo.co.uk trustlevel-...@yahoo.co.uk wrote:
 I've seen examples of earlier versions than Apache 1.3.29 said to be working
 with byte-range requests, has anyone got the byte range requests to work with
 openbsd without using php code or know how this can be done or if it works by
 default.

sorry, it's broken, maybe someone who uses base httpd and has some
spare time might like to look into fixing it...

http://permalink.gmane.org/gmane.os.openbsd.misc/169541