Testing ‘Apache Killer’

I ran the tool to attack this server as well as my employer’s load balanced array of servers. It is clear that only those servers running an older version of Apache (i.e. 1.3) and those not protected by a firewall are at risk.

My underpowered virtual private server crashed just a few seconds after the attack began. The tool revealed that my employer’s web sites did not appear to be vulnerable.

Is there a solution?

While a solution from Apache.org has not been published, some of the contributors have identified the issue and are working on a patch. In the meantime, you can add the following rule to your virtual site definitions, if you own your sever, or .htaccess file if you’re in a shared-hosting environment.

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(HEAD|GET) [NC]
RewriteCond %{HTTP:Range} ([0-9]*-[0-9]*)(\s*,\s*[0-9]*-[0-9]*)+
RewriteRule .* - [F]
</IfModule>

The preceding rule blocks “get and head requests with multiple ranges in the Range HTTP header.”

After applying this rule, feel free to attempt to kill your server, it will not crash. You should inspect your traffic logs to verify the incoming traffic is denied access with an HTTP status of 403, or forbidden.

Dirk-Willem van Gulik from Apache published this workaround for versions 2.0 and 2.2:

<IfModule mod_setenvif.c>
# Drop the Range header when more than 5 ranges.
# CVE-2011-3192
SetEnvIf Range (,.*?){5,} bad-range=1
RequestHeader unset Range env=bad-range

# optional logging.
CustomLog logs/range-CVE-2011-3192.log common env=bad-range
</IfModule>

Requirements

Make sure xmllint is installed on your machine and it is in your path. It’s part of libxml.

man xmllint

The command above should display the manual for xmllint if the program has been installed. Hit the q key to exit.

Create a Custom Function

Add the following user defined command to your .vimrc file:

vim ~/.vimrc

function! DoCleanXML()
        " save the filetype so we can restore it later
        let l:origft = &ft
        set ft=
        " delete the xml header if it exists. This will
        " permit us to surround the document with fake tags
        " without creating invalid xml.
        1s/<?xml .*?>//e
        " insert fake tags around the entire document.
        " This will permit us to pretty-format excerpts of
        " XML that may contain multiple top-level elements.
        0put ='<CleanXML>'
        $put ='</CleanXML>'
        silent %!xmllint --format --encode utf-8 -
        " xmllint will insert an <?xml?> header setting its
        " encoding type to utf-8
        " delete the fake tags
        2d
        $d
        " restore the normal indentation
        silent %<
        " back to home
        1
        " restore the filetype
        exe "set ft=" . l:origft
endfunction
command! CleanXML call DoCleanXML()

Set the indent character by adding the following environment variable to your .profile or similar file. In my case I inserted a tab between the double quotes.

export XMLLINT_INDENT=" "

Reload your environment

source ~/.profile

How to use it

Your custom command, CleanXML, is now available within your Vim editor. To use it, edit an XML file and type the following command to clean up its contents: :CleanXML and hit enter.

This was adapted from a solution found on the Vim Tips Wiki

One critical way is to reduce the number of external files loaded by a page. Another one is to reduce their size through compression. This post aims to take this concept a step further by automating this tedious process using open-source libraries.

Example

This example will accomplish the task by executing the following steps:

1. Create a temporary directory, /build
2. Compress each JS file into {original}-min.js files
3. Compress each CSS file into {original}-min.css files
4. Concatenate all compressed JS files into /js/complete.js
5. Concatenate all compressed CSS files into /css/complete.css

Requirements

• Make sure Apache Ant has been installed on your system.
• Check out a copy of the sample project from my public SVN repository. This project already contains the open-source libraries necessary, YUI compressor and YUI compressor Ant task.
• Setup a system variable, COMPRESSOR_HOME that points to the location of the sample project’s /lib directory.
  • On Windows, right click My Computer and select properties. Then click the “Environment Variables” button under the advanced tab. Add a new system variable, COMPRESSOR_HOME, and set its value to your local path, for example: C:\Documents and Settings\username\Desktop\yui-compression-sample\lib
  • On Mac OSX and Linux, update ~/.profile or similar file and add export COMPRESSOR_HOME=~/YourProjectDir/yui-compression-sample/lib

Examine the configuration

Take a look at the contents of build.xml. The first portion defines variables and locations of the libraries.

<!-- tells Ant to refer to your environment vars -->
<property environment="env" />

<!-- defines location of libraries -->
<property name="lib.dir" value="${env.COMPRESSOR_HOME}" />

<!-- defines output directory -->
<property name="build.dir" value="build" />

<!-- output files, one for JS one for CSS -->
<property name="final_js" value="${basedir}/js/complete.js" />
<property name="final_css" value="${basedir}/css/complete.css" />

<!-- define nicknames for libraries -->
<property name="yui-compressor" location="${lib.dir}/yuicompressor-2.4.2.jar" />
<property name="yui-compressor-ant-task" location="${lib.dir}/yui-compressor-ant-task-0.5.jar" />

<!-- adds libraries to the classpath -->
<path id="yui.classpath">
	<pathelement location="${yui-compressor}" />
	<pathelement location="${yui-compressor-ant-task}" />
</path>

<!-- define tasks -->
<taskdef name="yui-compressor" classname="net.noha.tools.ant.yuicompressor.tasks.YuiCompressorTask">
	<classpath refid="yui.classpath" />
</taskdef>

The second portion of build.xml defines the Ant targets to be executed. These tell YUI compressor how the source files are to be processed.

<!-- targets -->
<target name="concat">

	<!-- concatenates all compressed JS files into one -->
	<concat destfile="${final_js}" force="true" fixlastline="true">
		<fileset dir="${build.dir}" includes="**/*.js" />
		<fileset dir="${build.dir}" includes="**/widgets/*.js" />
	</concat>

	<!-- concatenates all compressed CSS files into one -->
	<concat destfile="${final_css}" force="true" fixlastline="true">
		<fileset dir="${build.dir}" includes="**/*.css" />
		<fileset dir="${build.dir}" includes="**/flexgrid/*.css" />
	</concat>

</target>

<target name="compress">

	<!-- compresses each JavaScript and CSS file -->
	<!-- and saved as {original_name}-min.{extension} -->
	<yui-compressor
		warn="false"
		munge="true"
		preserveallsemicolons="false"
		fromdir="${basedir}"
		todir="${build.dir}"
	/>

</target>

<!-- deletes the temporary directory and all its contents -->
<target name="clean">
	<delete dir="${build.dir}"/>
</target>

<!-- creates the temporary directory -->
<target name="start">
	<mkdir dir="${build.dir}" />
</target>

<target name="main" depends="start,compress,concat,clean" />

What does this do?

If you are new to Ant you are probably wondering why the tasks are defined in reverse order of execution. This is just a personal preference and it does not affect execution.

The order of execution is controlled by the main task. This is the task Ant runs when a target is not passed to it. The attribute depends tells Ant the order in which the tasks must be executed.

Give it a try

All you have to do to execute the entire operation is open a command prompt (or a terminal window on OS X), change into the project directory where build.xml lives and type ant and hit Enter. You should see some output that looks like this:

claude$ ant
Buildfile: build.xml

start:
     [echo] Building JS-CSS-Compression-and-Concat-Sample with Apache Ant version 1.7.1 compiled on April 8 2010 - System Java 1.6
    [mkdir] Created dir: /Users/claude/Documents/www/yui-compression-sample/build

compress:
[yui-compressor] [53%] global-print.css [920] ---> global-print-min.css [488]
[yui-compressor] [80%] global.css [11895] ---> global-min.css [9564]
[yui-compressor] [79%] style.css [1148] ---> style-min.css [910]
[yui-compressor] [64%] googlemaps-yelp-ext.js [6604] ---> googlemaps-yelp-ext-min.js [4270]
[yui-compressor] [70%] split-filepath.js [814] ---> split-filepath-min.js [576]
[yui-compressor] [73%] ContactForm.js [4711] ---> ContactForm-min.js [3461]
[yui-compressor] [57%] InfoTabs.js [1160] ---> InfoTabs-min.js [669]
[yui-compressor] [55%] InfoWindow.js [1228] ---> InfoWindow-min.js [686]
[yui-compressor] [68%] Intraday.js [9559] ---> Intraday-min.js [6536]
[yui-compressor] [68%] MediaCenter.js [5728] ---> MediaCenter-min.js [3906]
[yui-compressor] [JavaScript] Compressed 7 files to 67% (29KB to 19KB, saving 10KB)
[yui-compressor] [CSS] Compressed 3 files to 78% (13KB to 10KB, saving 3KB)
[yui-compressor] Compressed 10 files to 70% (42KB to 30KB, saving 12KB)

concat:
     [echo] Building /Users/claude/Documents/www/yui-compression-sample/js/complete.js
     [echo] Building /Users/claude/Documents/www/yui-compression-sample/css/complete.css

clean:
   [delete] Deleting directory /Users/claude/Documents/www/yui-compression-sample/build

main:

BUILD SUCCESSFUL
Total time: 1 second

What Now?

Change your HTML code to point to the newly created complete.js and complete.css instead of the individual files. Your page will load and render faster.

Squeeze even more performance out of your site by implementing other best practices. Get a copy of High Performance Web Sites by Steve Souders and read Yahoo’s rules for exceptional performance.

Watch Steve Souders’ presentation at Google Tech Talks. Audio problems are fixed 5 minutes in. Skip the first 90 seconds to listen to Steve.

Despite looking like a typical select box, Ext.form.ComboBox doesn’t behave exactly as you would expect since it submits the display text instead of the selected option’s value. The documentation states:

A ComboBox works in a similar manner to a traditional HTML <select> field. The difference is that to submit the valueField, you must specify a hiddenName to create a hidden input field to hold the value of the valueField. The displayField is shown in the text field which is named according to the name.

this.add([
	{
		xtype: 'combo',
		name: 'suffix',
		hiddenName: 'suffixId', // post this name
		hiddenValue: 0, // default value
		fieldLabel: 'Suffix',
		mode: 'local',
		store: this.suffixStore,
		valueField: 'key',
		displayField: 'display',
		triggerAction: 'all',
		forceSelection: true,
		allowBlank: true
	}
]);

Adding a hiddenName and a default value in hiddenValue does the trick, the default value (0) is set in the hidden field until a user chooses a different value. Unfortunately this breaks when the ComboBox is set to allow blanks and the user tabs over the field. When this happens, the hiddenValue is set to a null string and the user is never prompted to select a value.

Upon form submission, the hiddenField (suffixId) will be set to neither the default nor a valid value.

One solution is to listen for the focus and blur events to reset the value of the hidden field when it has been set to a null string.

this.add([
	{
		xtype: 'combo',
		name: 'suffix',
		hiddenName: 'suffixId',
		hiddenValue: 0,
		fieldLabel: 'Suffix',
		mode: 'local',
		store: this.suffixStore,
		valueField: 'key',
		displayField: 'display',
		triggerAction: 'all',
		forceSelection: true,
		allowBlank: true,
		listeners: {
			'focus': this.handleSuffixChange,
			'blur': this.handleSuffixChange,
			scope: this
		}
	}
]);

handleSuffixChange: function(field) {
	if (field.value==='') {
		field.hiddenField.value = '0';
	}
}

Upon form submission you will be guaranteed a valid value, which is especially beneficial if you’re using the form values to populate a server side bean object.

Have you reset your PRAM and NVRAM lately?

After a bit of Googling for a fairly recent and verifiable solution I decided to reset the machine’s parameter random access memory (PRAM) and nonvolatile RAM (NVRAM) as suggested by some folks and Apple’s technical support site. It works!

Try this before you declare your SuperDrive dead and go out and buy a new one.

The task becomes a lot easier under Apache. So I threw away the plugin code and added the following rule to the Apache configuration:

<directory "/public_html/mysite.com">
RewriteEngine on
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*) https://%{HTTP_HOST}/$1	[R,L]
</directory>

The directive above can be placed inside a VirtualHost or Directory directives, but this usually requires access to the Apache server configuration, which is not typically possible in a shared hosting environment — in that case, the rule can be added to the .htaccess file.

Alternatively we could have used the SSLRequireSSL Apache (2.x) directive, but this would only block access to the non HTTPS address. In our case we want to automatically redirect the users instead of displaying an error message.

ITunes began crashing on Super Bowl Sunday after I upgraded my iPod Touch to the latest firmware, version 2.2.1 — Since then I have reinstalled iTunes, did a factory restore of the iPod to no avail.

A few minutes ago I was looking through the Apple discussion groups and came across this fix by Jeff McCord. It is a simple one when you think about it:

1. Deauthorize your computer
2. Authorize it again
3. Visit the App Store and “Buy” a free app
4. Sync up

I am a happy camper again. All my music, movies, videos and audio books are back!

Hands-On Ext is a fast-paced session in which we will build an Ext application in less than an hour. This session demonstrates how to get started using Ext JS and how quickly you can put together a simple application from scratch. Learn how to utilize Ext’s high-level UI widgets like GridPanel, TabPanel and FormPanel instead of re-inventing the wheel.

In this session you learn how to:

• Create an application from scratch with Ext JS
• Utilize Ext’s high-level UI widgets, such as GridPanel, TabPanel and FormPanel.

Sign up now.

To construct the basic menu, Kriesi takes advantage of CSS Sprites, a technique to reduce the number of image files necessary to accomplish things like rollovers, without the need to preload the images using JavaScript.

A single image contains all the navigation menu options in their normal and active states and CSS rules are used to move the appropriate menu option into view. Once the basic menu is working, animation is added by using Kwicks for jQuery, a plugin written by Jerry Martin, resulting in the final product seen here.

UPDATE:I’ve created a tutorial that uses the latest version of the extension and Ext-JS.

Ext.ns('Sample');
Sample.ExtGMap = function() {

	var el = 'ext-map';

	function _init() {

		new Ext.Panel({
			renderTo: el,
			layout: 'fit',
			height: 300,
			hideLabel: true,
			items: [
		        {
		        	xtype: 'gmappanel',
		        	gmapType: 'map',
		        	zoomLevel: 14,
		            setCenter: {
		        		lat: 40.782686,
		        		lng: -73.96524,
			            marker: {
		        			title: 'Central Park'
			            }
			        }
		        }
			]
		});

	}

	return {
		init: _init
	}

}();
Ext.onReady(Sample.ExtGMap.init, Sample.ExtGMap);

Configuration options:

It’s just as easy to create a Google map window that maps addresses and places markers at their locations (which could just as easily be nested in a layout instead).

A couple of the primary Google maps handlers and settings are setup as configuration options. For instance, ‘addControl’ allows adding of a standard Google map control (zoom, pan, etc) and the ‘zoomLevel’ sets a default zoom level for the map.

Geocoding can be used by substituting the lat/long configuration options with a ‘geoCodeAddr’ string.

The ’setCenter’ configuration allows the default center location of the map to be set, along with a marker. More markers can be added to the map using the ‘markers’ array.

The guys at Cozi have created a server side solution that takes the pain out of combining these files in some sort of intermediary build process. Here is how they go about doing it:

<WebClientCode:CombinerControl ID=”CombineScript” runat=”server”>

<script src=”script/third-party/jquery.js” type=”text/javascript”></script>

<script src=”script/third-party/sifr.js” type=”text/javascript”></script>

<script src=”script/third-party/soundmanager.js” type=”text/javascript”></script>

<script src=”script/cozi_date.js” type=”text/javascript”></script>

</WebClientCode:CombinerControl>

The combiner outputs a reference to an Http Handler which will serve the combined file:

<script src=“../Combiner/Combiner.ashx?ext=js ?
&ver=59169b00 ?
&type=text%2fjavascript ?
&files=!script’third-party*jquery*sifr*soundmanager*!script*cozi_date*” ?
type=”text/javascript”></script>

Although they do not provide the source code for the ASP.NET control, they do point to an old article on Vitamin, Serving JavaScript Fast, that served as their inspiration.

Personally I prefer combining the files before they get pushed to production in a build process, as doing it while the client may introduce unexpected delays depending on the traffic load a any given time.

What do you do to improve performance on your web sites?

So, I checked the TextPad help to see if I could pass in the name of a file containing full file paths for TextPad to open.

You just need to put an at sign (@) before the filename, and TextPad will look at that file to find a list of files to open. So, I decided to create a temporary file, output the filenames found and converted by my set of commands (above) into that temporary file, and then run TextPad, passing the temporary filename preceded by an @ sign.

textpad $(for g in 'for f in \'grep -Rli "new Ext.Panel" *\'; do (grep -Hn -m 1 "new Ext.Panel" $f | sed -e 's/\(^[^:]\+\):\([0-9]\+\):.*$/\1(\2/g'); done'; do echo 'cygpath -w -a ${g/\(*/}'\(${g/*\(/},'grep -m 1 "new Ext.Panel" ${g/(*/} | sed -e 's/\t/ /g' -e 's/new Ext.Panel.*$//g' | wc -c'\); done) &

I’m sure this could be done more efficiently, but this was a fun challenge to take on, and I managed to find a way to do what I wanted to do.

Read on…

Now, the project contains more than just the POIUtility.cfc; it also contains all the ColdFusion custom tags and some additional CSS-based components that can be used to create Microsoft Excel files in ColdFusion.

Read more about it.