Subject: RE: http1.1 problem

From: "Overdijk, Harrie" <[email-masked]>
Date: Tue, 11 Jul 2000 11:16:00 +0200

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello,

Joseph Yao wrote the following:

> -----Original Message-----
> From:	Joseph S D Yao [SMTP:[email-masked]]
> Sent:	Monday, July 10, 2000 5:11 PM
> To:	Mark C Farone
> Cc:	Rick Murphy; [email-masked]
> Subject:	Re: http1.1 problem
> 
> [To be removed from this list send the message "unsubscribe fwtk-users" in
> the
> BODY of a mail message to [email-masked].]
> 
> http-gw does bad things to %-encoded URLs.  I believe there was a patch
> on fwtk.org to remove this.  There was some exploit that this was
> preventing, but Marcus didn't remember what it was when I asked him a
> while ago, and I haven't figured it out either.  ;-]
> 
	[Harrie]  Back in 1997 there was a large discussion
	[Harrie]  about URL's with escaped nulls. Maybe you are
	[Harrie]  refering to that discussion? I have never seen
	[Harrie]  a patch for this and other encoded URL problems...
	[Harrie]  B.t.w. see fwtk-archive.9701.

	Greetings,
	          Harrie Overdijk

Harrie Overdijk, ECN, Postbox 1, 1755 ZG  Petten (NH), The Netherlands.
Internet: [email-masked]              Noisenet: +31 224 56 4597
Fidonet : 2:500/43.1902  (At home!)    FAXnet  : +31 224 56 1864
ICP/Postmaster/UseNet-News-manager/WWW-manager/Security-manager of ECN.

---

From: Tony Gale <[email-masked]>
Date: Tue, 11 Jul 2000 11:41:51 +0100 (BST)

http-gw doesn't follow the RFCs on this. When I find the right RFC
that lists all the unsafe URL characters I'll make a patch - can't
remember the RFC number at the moment (hint).

I've looked at this before, so know where in the code to do it.

-tony

> ICP/Postmaster/UseNet-News-manager/WWW-manager/Security-manager of

---
E-Mail: Tony Gale <[email-masked]>
A complex system that works is invariably found to have evolved from a
simple system that works.

The views expressed above are entirely those of the writer
and do not represent the views, policy or understanding of
any other person or official body.

---

From: Joseph S D Yao <[email-masked]>
Date: Tue, 11 Jul 2000 12:18:39 -0400

> Joseph Yao wrote the following:
...
> 	[Harrie]  B.t.w. see fwtk-archive.9701.

I know that several people have started writing this patch, and that
may be what I am thinking of.  I should have looked at fwtk.org before
answering, but I am still catching up from every hour spent away from
here.  ;-)  Mea culpa, mea culpa, mea maxima culpa.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Mark C Farone <[email-masked]>
Date: Wed, 12 Jul 2000 14:36:59 -0400

>here.  ;-)  Mea culpa, mea culpa, mea maxima culpa.

Ah, the perils of a vacation. :)

I didn't check the code in each patch, but I don't see any info on 
the fwtk.org site for any kind of patch to do with http-gw's hex 
encoding.
Any other considerations about this proposed patch?

By the way, is there an on-line archive of the mailing list from back then?
I don't have archives of this mailing list before 5/98.

Thanks again,
Mark
-- 
Mark C. Farone <[email-masked]>   In the future,
Systems Analyst, Gainesville Sun        everything will work.

---

From: Joseph S D Yao <[email-masked]>
Date: Wed, 12 Jul 2000 15:31:10 -0400

On Wed, Jul 12, 2000 at 02:36:59PM -0400, Mark C Farone wrote:
...
> I don't have archives of this mailing list before 5/98.

FAQ <URL: http://www.fwtk.org/fwtk/download/downloading.html#3.5>:

"The FWTK users mail list archive is at
ftp://ftp.tislabs.com/pub/firewall/toolkit/fwtk-users-archive/ .
You can find a searchable online archive at
http://www.progressive-comp.com/Lists/?l=fwtk-users&r=1&w=2#fwtk-users "

The former goes from 1994 to now.  The latter actually forwards me to
<URL: http://marc.theaimsgroup.com/?l=fwtk-users&r=1&w=2> and goes from
Aug 1995 to now.

[Who wants to fix the Meta-FAQ - the one that is for some reason
labeled "Downloads"?]

---

From: Keith Young <[email-masked]>
Date: Wed, 12 Jul 2000 15:58:51 -0400

> Any other considerations about this proposed patch?

I get to have a "free" weekend without business travelling this weekend
(yay!), so I'm planning to update fwtk.org on Saturday & Sunday.

> I don't have archives of this mailing list before 5/98.

Look here:
http://www.fwtk.org/fwtk/download/downloading.html#3.5

Archives go back to 07/1994.

-- 
--Keith Young
-Director of Customer Care/Support, V-ONE Corp.
[email-masked]

---

From: Tony Gale <[email-masked]>
Date: Thu, 13 Jul 2000 09:04:28 +0100 (BST)

> (yay!), so I'm planning to update fwtk.org on Saturday & Sunday.

Excellent. I'll send you a finalised patch in a private email.

-tony

---
E-Mail: Tony Gale <[email-masked]>
Be free and open and breezy!  Enjoy!  Things won't get any better so
get used to it.