You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@trafficserver.apache.org by Trilok Nathreddy <tr...@gmail.com> on 2021/06/21 12:25:45 UTC
Query
I have configured the ip allow file to allow specific hosts to go out to
internet in forward proxy deployment but I need to show an customized web
page to the users who are denied. I checked the body_factory default page
but it doesn't get popped to the users.do we need to configure anything
extra to link this html page to the ACL?
Regards
Trilok
9949994745
Re: [E] Query
Posted by Trilok Nathreddy <tr...@gmail.com>.
Alan,
For some reason I am unable to get in to apache slack channel with my
account trilokn@apache.org
any other way to connect to check this?
Regards
Trilok
Regards
Trilok
On Wed, Jun 23, 2021, 9:19 PM Alan Carroll <so...@verizonmedia.com>
wrote:
> Can you ping me on Slack?
>
> We use custom responses via body factory in production here for ATS 7, 9,
> and 9.1 so it should work. What exactly did you set in "records.config"?
> Does "/etc/trafficserver/body_factory" exist? Is that where you expect it
> to look?
>
> On Wed, Jun 23, 2021 at 6:07 AM Trilok Nathreddy <tr...@gmail.com>
> wrote:
>
>> Alan,
>>
>> I tested this again today , I have seen a lot of posts on this subject
>> where earlier other engineers have faced similar issue but the PR are
>> closed but didnt understand what the fix is.
>>
>> [Jun 23 09:15:09.356] [ET_NET 0] WARNING: Unable to access() directory
>> '/etc/trafficserver/body_factory': 2, No such file or directory
>> [Jun 23 09:15:09.356] [ET_NET 0] WARNING: Please set
>> 'proxy.config.body_factory.template_sets_dir'
>> [Jun 23 09:15:09.356] [ET_NET 0] WARNING: can't open response template
>> directory '/etc/trafficserver/body_factory' (No such file or directory)
>>
>> I have tried to set it in the records.config and am version 10 but still
>> no luck . So in principal then ATS will or will not support exception
>> pages to be prompted back to users with in an organisation looking to use
>> it as forward proxy deployment.
>>
>> Regards
>> Trilok
>> 9949994745
>>
>>
>> On Tue, Jun 22, 2021 at 6:55 PM Alan Carroll <
>> solidwallofcode@verizonmedia.com> wrote:
>>
>>> Any inbound connection that matches a "deny all" rule will be denied
>>> with no message. This is by design because of concern about denial of
>>> service attacks. The goal is to minimize resource consumption for denied
>>> connections from specific sources. I see that you are using method based
>>> permissions, which do need to read the user agent request before
>>> application. It's been a while since I've worked on that, I'll need to
>>> check the code to see how it is being handled in that case.
>>>
>>> On Tue, Jun 22, 2021 at 7:32 AM Trilok Nathreddy <tr...@gmail.com>
>>> wrote:
>>>
>>>> Alan,
>>>>
>>>> So any thing denied from ip_allow can't be notified with custom
>>>> exception page using the body_factory pages or any built in deny page?
>>>>
>>>> Regards
>>>> Trilok
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> On Mon, Jun 21, 2021, 10:02 PM Alan Carroll <
>>>> solidwallofcode@verizonmedia.com> wrote:
>>>>
>>>>> Ah, I misread your comment and thought you were using the outbound
>>>>> controls. Unfortunately the point of the inbound control is to not talk to
>>>>> banned user agents as little as possible and so the connection is
>>>>> terminated immediately after the accept. No response is possible since ATS
>>>>> doesn't even know what protocol the user agent is using (TLS? HTTP/2?
>>>>> FTP?). What version of ATS are you using?
>>>>>
>>>>> On Mon, Jun 21, 2021 at 11:17 AM Trilok Nathreddy <tr...@gmail.com>
>>>>> wrote:
>>>>>
>>>>>> Alan,
>>>>>>
>>>>>> No
>>>>>>
>>>>>> On Mon, Jun 21, 2021, 7:26 PM Alan Carroll <
>>>>>> solidwallofcode@verizonmedia.com> wrote:
>>>>>>
>>>>>>> The "access#defined" template doesn't get used?
>>>>>>>
>>>>>>> On Mon, Jun 21, 2021 at 7:26 AM Trilok Nathreddy <tr...@gmail.com>
>>>>>>> wrote:
>>>>>>>
>>>>>>>> I have configured the ip allow file to allow specific hosts to go
>>>>>>>> out to internet in forward proxy deployment but I need to show an
>>>>>>>> customized web page to the users who are denied. I checked the body_factory
>>>>>>>> default page but it doesn't get popped to the users.do we need to configure
>>>>>>>> anything extra to link this html page to the ACL?
>>>>>>>>
>>>>>>>> Regards
>>>>>>>> Trilok
>>>>>>>> 9949994745
>>>>>>>>
>>>>>>>
Re: [E] Query
Posted by Alan Carroll <so...@verizonmedia.com>.
Can you ping me on Slack?
We use custom responses via body factory in production here for ATS 7, 9,
and 9.1 so it should work. What exactly did you set in "records.config"?
Does "/etc/trafficserver/body_factory" exist? Is that where you expect it
to look?
On Wed, Jun 23, 2021 at 6:07 AM Trilok Nathreddy <tr...@gmail.com> wrote:
> Alan,
>
> I tested this again today , I have seen a lot of posts on this subject
> where earlier other engineers have faced similar issue but the PR are
> closed but didnt understand what the fix is.
>
> [Jun 23 09:15:09.356] [ET_NET 0] WARNING: Unable to access() directory
> '/etc/trafficserver/body_factory': 2, No such file or directory
> [Jun 23 09:15:09.356] [ET_NET 0] WARNING: Please set
> 'proxy.config.body_factory.template_sets_dir'
> [Jun 23 09:15:09.356] [ET_NET 0] WARNING: can't open response template
> directory '/etc/trafficserver/body_factory' (No such file or directory)
>
> I have tried to set it in the records.config and am version 10 but still
> no luck . So in principal then ATS will or will not support exception
> pages to be prompted back to users with in an organisation looking to use
> it as forward proxy deployment.
>
> Regards
> Trilok
> 9949994745
>
>
> On Tue, Jun 22, 2021 at 6:55 PM Alan Carroll <
> solidwallofcode@verizonmedia.com> wrote:
>
>> Any inbound connection that matches a "deny all" rule will be denied with
>> no message. This is by design because of concern about denial of service
>> attacks. The goal is to minimize resource consumption for denied
>> connections from specific sources. I see that you are using method based
>> permissions, which do need to read the user agent request before
>> application. It's been a while since I've worked on that, I'll need to
>> check the code to see how it is being handled in that case.
>>
>> On Tue, Jun 22, 2021 at 7:32 AM Trilok Nathreddy <tr...@gmail.com>
>> wrote:
>>
>>> Alan,
>>>
>>> So any thing denied from ip_allow can't be notified with custom
>>> exception page using the body_factory pages or any built in deny page?
>>>
>>> Regards
>>> Trilok
>>>
>>>
>>>
>>>
>>>
>>> On Mon, Jun 21, 2021, 10:02 PM Alan Carroll <
>>> solidwallofcode@verizonmedia.com> wrote:
>>>
>>>> Ah, I misread your comment and thought you were using the outbound
>>>> controls. Unfortunately the point of the inbound control is to not talk to
>>>> banned user agents as little as possible and so the connection is
>>>> terminated immediately after the accept. No response is possible since ATS
>>>> doesn't even know what protocol the user agent is using (TLS? HTTP/2?
>>>> FTP?). What version of ATS are you using?
>>>>
>>>> On Mon, Jun 21, 2021 at 11:17 AM Trilok Nathreddy <tr...@gmail.com>
>>>> wrote:
>>>>
>>>>> Alan,
>>>>>
>>>>> No
>>>>>
>>>>> On Mon, Jun 21, 2021, 7:26 PM Alan Carroll <
>>>>> solidwallofcode@verizonmedia.com> wrote:
>>>>>
>>>>>> The "access#defined" template doesn't get used?
>>>>>>
>>>>>> On Mon, Jun 21, 2021 at 7:26 AM Trilok Nathreddy <tr...@gmail.com>
>>>>>> wrote:
>>>>>>
>>>>>>> I have configured the ip allow file to allow specific hosts to go
>>>>>>> out to internet in forward proxy deployment but I need to show an
>>>>>>> customized web page to the users who are denied. I checked the body_factory
>>>>>>> default page but it doesn't get popped to the users.do we need to configure
>>>>>>> anything extra to link this html page to the ACL?
>>>>>>>
>>>>>>> Regards
>>>>>>> Trilok
>>>>>>> 9949994745
>>>>>>>
>>>>>>
Re: [E] Query
Posted by Alan Carroll <so...@verizonmedia.com>.
Final resolution - the issue with the body templates was just
misconfiguration, easily solved.
The other problem was a bit trickier. For inbound IP allow processing, if
no methods are permitted then the connection is immediately closed in order
to prevent DOS attacks. To get the effect Trilok wanted the IP allow check
needs to be delayed. The best way I could see to do this is to allow a
nonsensical method. This cause the processing to delay until after the
request has been parsed in order to check the method, but will
(effectively) block any method and provide a standard denied response which
uses the body templates. Something like
ip_allow:
apply: in
ip_addr: 192.168.0.0/16
action: allow
method: "Twas brillig and the slithy toves did gyre and gimble in the
wabe"
This allows inbound from those addresses but only if the method is about
slithy toves. All other methods will be denied. Because methods can't have
spaces (due to the way the request is
parsed) it is not really possible for this to allow the request and even if
it does nothing upstream is going to understand it.
I think we may want to formalize this and add an option to prevent an early
decision, so one could do
apply: in
ip_addr: 192.168.0.0/16
action: deny
early: disable # don't close in early processing.
Re: [E] Query
Posted by Trilok Nathreddy <tr...@gmail.com>.
Alan,
I tested this again today , I have seen a lot of posts on this subject
where earlier other engineers have faced similar issue but the PR are
closed but didnt understand what the fix is.
[Jun 23 09:15:09.356] [ET_NET 0] WARNING: Unable to access() directory
'/etc/trafficserver/body_factory': 2, No such file or directory
[Jun 23 09:15:09.356] [ET_NET 0] WARNING: Please set
'proxy.config.body_factory.template_sets_dir'
[Jun 23 09:15:09.356] [ET_NET 0] WARNING: can't open response template
directory '/etc/trafficserver/body_factory' (No such file or directory)
I have tried to set it in the records.config and am version 10 but still no
luck . So in principal then ATS will or will not support exception pages
to be prompted back to users with in an organisation looking to use it as
forward proxy deployment.
Regards
Trilok
9949994745
On Tue, Jun 22, 2021 at 6:55 PM Alan Carroll <
solidwallofcode@verizonmedia.com> wrote:
> Any inbound connection that matches a "deny all" rule will be denied with
> no message. This is by design because of concern about denial of service
> attacks. The goal is to minimize resource consumption for denied
> connections from specific sources. I see that you are using method based
> permissions, which do need to read the user agent request before
> application. It's been a while since I've worked on that, I'll need to
> check the code to see how it is being handled in that case.
>
> On Tue, Jun 22, 2021 at 7:32 AM Trilok Nathreddy <tr...@gmail.com>
> wrote:
>
>> Alan,
>>
>> So any thing denied from ip_allow can't be notified with custom exception
>> page using the body_factory pages or any built in deny page?
>>
>> Regards
>> Trilok
>>
>>
>>
>>
>>
>> On Mon, Jun 21, 2021, 10:02 PM Alan Carroll <
>> solidwallofcode@verizonmedia.com> wrote:
>>
>>> Ah, I misread your comment and thought you were using the outbound
>>> controls. Unfortunately the point of the inbound control is to not talk to
>>> banned user agents as little as possible and so the connection is
>>> terminated immediately after the accept. No response is possible since ATS
>>> doesn't even know what protocol the user agent is using (TLS? HTTP/2?
>>> FTP?). What version of ATS are you using?
>>>
>>> On Mon, Jun 21, 2021 at 11:17 AM Trilok Nathreddy <tr...@gmail.com>
>>> wrote:
>>>
>>>> Alan,
>>>>
>>>> No
>>>>
>>>> On Mon, Jun 21, 2021, 7:26 PM Alan Carroll <
>>>> solidwallofcode@verizonmedia.com> wrote:
>>>>
>>>>> The "access#defined" template doesn't get used?
>>>>>
>>>>> On Mon, Jun 21, 2021 at 7:26 AM Trilok Nathreddy <tr...@gmail.com>
>>>>> wrote:
>>>>>
>>>>>> I have configured the ip allow file to allow specific hosts to go out
>>>>>> to internet in forward proxy deployment but I need to show an customized
>>>>>> web page to the users who are denied. I checked the body_factory default
>>>>>> page but it doesn't get popped to the users.do we need to configure
>>>>>> anything extra to link this html page to the ACL?
>>>>>>
>>>>>> Regards
>>>>>> Trilok
>>>>>> 9949994745
>>>>>>
>>>>>
Re: [E] Query
Posted by Alan Carroll <so...@verizonmedia.com>.
Any inbound connection that matches a "deny all" rule will be denied with
no message. This is by design because of concern about denial of service
attacks. The goal is to minimize resource consumption for denied
connections from specific sources. I see that you are using method based
permissions, which do need to read the user agent request before
application. It's been a while since I've worked on that, I'll need to
check the code to see how it is being handled in that case.
On Tue, Jun 22, 2021 at 7:32 AM Trilok Nathreddy <tr...@gmail.com> wrote:
> Alan,
>
> So any thing denied from ip_allow can't be notified with custom exception
> page using the body_factory pages or any built in deny page?
>
> Regards
> Trilok
>
>
>
>
>
> On Mon, Jun 21, 2021, 10:02 PM Alan Carroll <
> solidwallofcode@verizonmedia.com> wrote:
>
>> Ah, I misread your comment and thought you were using the outbound
>> controls. Unfortunately the point of the inbound control is to not talk to
>> banned user agents as little as possible and so the connection is
>> terminated immediately after the accept. No response is possible since ATS
>> doesn't even know what protocol the user agent is using (TLS? HTTP/2?
>> FTP?). What version of ATS are you using?
>>
>> On Mon, Jun 21, 2021 at 11:17 AM Trilok Nathreddy <tr...@gmail.com>
>> wrote:
>>
>>> Alan,
>>>
>>> No
>>>
>>> On Mon, Jun 21, 2021, 7:26 PM Alan Carroll <
>>> solidwallofcode@verizonmedia.com> wrote:
>>>
>>>> The "access#defined" template doesn't get used?
>>>>
>>>> On Mon, Jun 21, 2021 at 7:26 AM Trilok Nathreddy <tr...@gmail.com>
>>>> wrote:
>>>>
>>>>> I have configured the ip allow file to allow specific hosts to go out
>>>>> to internet in forward proxy deployment but I need to show an customized
>>>>> web page to the users who are denied. I checked the body_factory default
>>>>> page but it doesn't get popped to the users.do we need to configure
>>>>> anything extra to link this html page to the ACL?
>>>>>
>>>>> Regards
>>>>> Trilok
>>>>> 9949994745
>>>>>
>>>>
Re: [E] Query
Posted by Trilok Nathreddy <tr...@gmail.com>.
Alan,
So any thing denied from ip_allow can't be notified with custom exception
page using the body_factory pages or any built in deny page?
Regards
Trilok
On Mon, Jun 21, 2021, 10:02 PM Alan Carroll <
solidwallofcode@verizonmedia.com> wrote:
> Ah, I misread your comment and thought you were using the outbound
> controls. Unfortunately the point of the inbound control is to not talk to
> banned user agents as little as possible and so the connection is
> terminated immediately after the accept. No response is possible since ATS
> doesn't even know what protocol the user agent is using (TLS? HTTP/2?
> FTP?). What version of ATS are you using?
>
> On Mon, Jun 21, 2021 at 11:17 AM Trilok Nathreddy <tr...@gmail.com>
> wrote:
>
>> Alan,
>>
>> No
>>
>> On Mon, Jun 21, 2021, 7:26 PM Alan Carroll <
>> solidwallofcode@verizonmedia.com> wrote:
>>
>>> The "access#defined" template doesn't get used?
>>>
>>> On Mon, Jun 21, 2021 at 7:26 AM Trilok Nathreddy <tr...@gmail.com>
>>> wrote:
>>>
>>>> I have configured the ip allow file to allow specific hosts to go out
>>>> to internet in forward proxy deployment but I need to show an customized
>>>> web page to the users who are denied. I checked the body_factory default
>>>> page but it doesn't get popped to the users.do we need to configure
>>>> anything extra to link this html page to the ACL?
>>>>
>>>> Regards
>>>> Trilok
>>>> 9949994745
>>>>
>>>
Re: [E] Query
Posted by Alan Carroll <so...@verizonmedia.com>.
Ah, I misread your comment and thought you were using the outbound
controls. Unfortunately the point of the inbound control is to not talk to
banned user agents as little as possible and so the connection is
terminated immediately after the accept. No response is possible since ATS
doesn't even know what protocol the user agent is using (TLS? HTTP/2?
FTP?). What version of ATS are you using?
On Mon, Jun 21, 2021 at 11:17 AM Trilok Nathreddy <tr...@gmail.com> wrote:
> Alan,
>
> No
>
> On Mon, Jun 21, 2021, 7:26 PM Alan Carroll <
> solidwallofcode@verizonmedia.com> wrote:
>
>> The "access#defined" template doesn't get used?
>>
>> On Mon, Jun 21, 2021 at 7:26 AM Trilok Nathreddy <tr...@gmail.com>
>> wrote:
>>
>>> I have configured the ip allow file to allow specific hosts to go out to
>>> internet in forward proxy deployment but I need to show an customized web
>>> page to the users who are denied. I checked the body_factory default page
>>> but it doesn't get popped to the users.do we need to configure anything
>>> extra to link this html page to the ACL?
>>>
>>> Regards
>>> Trilok
>>> 9949994745
>>>
>>
Re: [E] Query
Posted by Trilok Nathreddy <tr...@gmail.com>.
Alan,
No
On Mon, Jun 21, 2021, 7:26 PM Alan Carroll <so...@verizonmedia.com>
wrote:
> The "access#defined" template doesn't get used?
>
> On Mon, Jun 21, 2021 at 7:26 AM Trilok Nathreddy <tr...@gmail.com>
> wrote:
>
>> I have configured the ip allow file to allow specific hosts to go out to
>> internet in forward proxy deployment but I need to show an customized web
>> page to the users who are denied. I checked the body_factory default page
>> but it doesn't get popped to the users.do we need to configure anything
>> extra to link this html page to the ACL?
>>
>> Regards
>> Trilok
>> 9949994745
>>
>
Re: [E] Query
Posted by Alan Carroll <so...@verizonmedia.com>.
The "access#defined" template doesn't get used?
On Mon, Jun 21, 2021 at 7:26 AM Trilok Nathreddy <tr...@gmail.com> wrote:
> I have configured the ip allow file to allow specific hosts to go out to
> internet in forward proxy deployment but I need to show an customized web
> page to the users who are denied. I checked the body_factory default page
> but it doesn't get popped to the users.do we need to configure anything
> extra to link this html page to the ACL?
>
> Regards
> Trilok
> 9949994745
>