You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2010/04/12 21:48:26 UTC
DO NOT REPLY [Bug 49099] New: Using % after context prefix results
in 400 but nothing is logged in access log
https://issues.apache.org/bugzilla/show_bug.cgi?id=49099
Summary: Using % after context prefix results in 400 but
nothing is logged in access log
Product: Tomcat 6
Version: 6.0.26
Platform: PC
OS/Version: Linux
Status: NEW
Severity: major
Priority: P2
Component: Catalina
AssignedTo: dev@tomcat.apache.org
ReportedBy: igor@fedulov.com
Simple test:
1. Download latest tomcat 6.0.26
2. Utar it and start it up
3. Head over to http://localhost:8080/ to verify that it's working
4. Now change the URL to something like http://localhost:8080/%foo and you get
error 400 as expected but nothing is logged in access log:
http://localhost:8080/%foo
GET /%foo HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100401
Ubuntu/9.10 (karmic) Firefox/3.5.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
HTTP/1.1 400 Bad Request
Server: Apache-Coyote/1.1
Content-Length: 0
Date: Mon, 12 Apr 2010 19:44:57 GMT
Connection: close
5. Now change the URL to legitimate, i.e.: http://localhost:8080/%29 and you
get 404 as expected and it's also logged in access log as expected.
http://localhost:8080/%29
GET /%29 HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100401
Ubuntu/9.10 (karmic) Firefox/3.5.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Length: 964
Date: Mon, 12 Apr 2010 19:43:45 GMT
So for admin of the server there is no way to see if there is a DDoS attack
going on on the box because there is nothing written to the log files, nothing
at all.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 49099] Using % after context prefix results in 400
but nothing is logged in access log
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49099
--- Comment #5 from Igor Fedulov <ig...@fedulov.com> 2010-06-02 11:23:44 EDT ---
Excellent, thank you Mark!
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 49099] Using % after context prefix results in 400
but nothing is logged in access log
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49099
--- Comment #3 from Mark Thomas <ma...@apache.org> 2010-04-27 08:53:26 EDT ---
There is currently no way within Tomcat to log the malformed requests. There
are a couple of options for addressing this. The ideal would include adding
entries to the access log, if any, but that is going to be more complex than
the simple solution of using Tomcat's standard logging. I'll kick off a
discussion on the dev list about how this might be done.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 49099] Using % after context prefix results in 400
but nothing is logged in access log
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49099
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |WONTFIX
--- Comment #1 from Mark Thomas <ma...@apache.org> 2010-04-12 15:56:39 EDT ---
This is working as designed. Bad urls are rejected before they reach the access
log valve.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 49099] Using % after context prefix results in 400
but nothing is logged in access log
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49099
Igor Fedulov <ig...@fedulov.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|WONTFIX |
--- Comment #2 from Igor Fedulov <ig...@fedulov.com> 2010-04-12 16:27:51 EDT ---
So what are the solutions from preventing DDoS attack if server doesn't log
malformed request attempts, not even the originating IP? You don't consider
this as a problem?
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 49099] Using % after context prefix results in 400
but nothing is logged in access log
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49099
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |FIXED
--- Comment #6 from Mark Thomas <ma...@apache.org> 2010-11-02 14:13:11 EDT ---
This has been fixed in 6.0.x and will be included in 6.0.30 onwards.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 49099] Using % after context prefix results in 400
but nothing is logged in access log
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49099
--- Comment #4 from Mark Thomas <ma...@apache.org> 2010-06-02 11:15:29 EDT ---
I have applied a fix for trunk (7.0.x) which will be included in 7.0.0 onwards
and proposed the same fix for 6.0.x
There wasn't complete agreement on the dev list on the right way to go for this
so there may be some tweaks before we reach a final solution.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org