WilliamLam.com

Disable HTTP Range Requests on Synology WebStation, Apache or Nginx

by // 2 Comments

I use my Synology NAS to host a variety of services including a web server, file server and a backup system. As part of some testing that I had been performing, I needed to ensure that my web server does not respond to HTTP Range Requests, which allow clients to retrieve specific byte ranges rather than downloading an entire resource in a single transfer.

We can check whether a web server supports HTTP Range Requests by specifying a range of bytes as demonstrated in this cURL example below:

curl -H "Range: bytes=0-10" -I http://depot.vcf.lab/PROD/vsan/hcl/lastupdatedtime.json -u $CREDS

Image
You should receive an HTTP 206 response which indicates HTTP Range Requests is supported by your web server, which my Synology supports by default.

Unlike a traditional web server where disabling HTTP Range Requests is pretty straightforward, modifying the default behavior for Synology WebStation is slightly more complicated. After some trial and error, I was able to successfully disable HTTP Range Requests on my Synology system, and for those with a similar requirement, the following sections outline the steps for several popular web server backends.

[Read more...]

Quick Tip - Correlating VCF Component to Bundle ID/Name

by // Leave a Comment

A VMware Cloud Foundation (VCF) release consists of a collection of VCF components that is categorized as either an installation or patch/upgrade file. In VCF 4.x/5.x, a VCF component would contain two different identifiers, a UUID as well as something called a Bundle ID (e.g. bundle-XXX where XXX is some numeric number). In VCF 9.x, the old Bundle ID format is no longer used and simply converges with using the UUID, uniquely identifying a given VCF component.

When a customer downloads a VCF release, they only need to deal with the VCF release version (e.g. 5.2.1.0 or 9.0.1.0) and not the individual bundle IDs. With that said, if you need to download a specific VCF component, especially when using the VCF Download Tool (VCFDT), then it would helpful to understand the specific VCF component ID whether this is for VCF 4.x/5.x or VCF 9.x

[Read more...]

TLS Chain of Trust when using SSL Inspection with VCF Download Tool (VCFDT)

by // Leave a Comment

SSL traffic inspection is commonly deployed by Enterprises to ensure that they have visibility into encrypted connections, enabling their organization to reduce security risks and enforce acceptable use policies.

When using the VCF Download Tool (VCFDT), the connection must first terminate at your SSL inspection system and you may come across the following error: Unable to connect to the Depot Server

Image
Taking a closer look at the VCFDT log file, we can quickly identify the problem which is due to validating the certificate chain from the SSL inspection system as you can see from this snippet:

Error checking certificate chain CN=depot.vcf.lab, OU=R&D, O=WilliamLam, L=Palo Alto, ST=CA, C=US, SerialNumber=91513477326140466830150858710326987151105506009,CN=WilliamLam-RootCA, OU=R&D, O=WilliamLam, L=Palo Alto, ST=CA, C=US, SerialNumber=659677038159141611554120742063414354480349425756 for validity.
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

To resolve this problem, we need to add the Root CA signing certificate into Java keystore that VCFDT can use to establish the chain of trust.

[Read more...]