fre 2014-07-25 klockan 19:05 +0300 skrev Eliezer Croitoru:
> The response to alex question why would anybody want to drop
> "cteonnt-length:" header:
> Some places do not allow cookies or POST for external services and it's
> sometimes can looks weird but I still understand why would it be
> considered a security hole by some minds.
Dropping mangled connection-length header is not about security. It's no
more than a garbage header carrying no meaning other than an distant
echo of it's original form. It is transformed in this manner to avoid
being read as connection-length while doing a minimal lightweight
rewrite of the TCP/IP payload.
Bandwidth saving from dropping this header will be close to
unmeasurable.
Security impact likewise.
But sure, if you have a whitelist policy of only allowing what is
explicitly allowed then it would be dropped by the catch-all DROP
policy. But no hardwiring in our code is needed for that.
The discussion about mangled Connection header may be more interesting,
but only if there is bugs in the software that mangled the Connection
header leaving what was intended as hop-by-hop headers unmangled. But I
don't see much of a point of worrying about that until there is
indication that there is problems caused by such headers.
From the referenced discussion it's quite clear this rewrite practice is
limited to one cache appliance vendor. It is not likely to be
implemented by others.
Regards
Henrik
Received on Sat Jul 26 2014 - 09:50:09 MDT
This archive was generated by hypermail 2.2.0 : Sat Jul 26 2014 - 12:00:12 MDT