[users@httpd] open proxy behavior problem

[Vincent Kargatis <ka...@kargatron.net>]

I've posted to several other forums, but haven't gotten any leads.

I have an apache server (port 80) using mod_proxy pointing to a modperl
port, the combo of which is acting like an open proxy even though I have
ProxyRequests turned Off.

the conf excerpt:
ProxyRequests Off
RewriteEngine on
RewriteRule ^/$ /index.html
#pass requests for / to /index.html
RewriteRule ^/index.html http://%{HTTP_HOST}:8008/index.html [P]
...

The 8008 port is modperl with no proxy configurations in httpd.conf at
all.  This combo is acting like an open proxy.  Commenting out that
RewriteRule stops the behavior.  Unfortunately, I neither understand
what about this configuration makes it act open, nor how to close it.

Ideally I want the reverse of ProxyBlock - I want to allow a pass only
to a specified set of servers, stopping any external targets.  (I don't
want to limit access, I just want to limit outbound.)

I see from
http://www.mail-archive.com/dev@httpd.apache.org/msg17546.html that
there seems to be a proposal for what I need, 'AllowHttpProxy', but
that's as yet unimplemented, afaik.

I need the RewriteRule because I need to pass the (in my case)
intentionally varying HTTP_HOST in the URL (well, at least, that's how
it's currently coded). Given that need, how can I avoid looking like an
open proxy? Is the modperl port acting like a default proxy?  As I
mentioned, commenting out that RewriteRule stops the behavior, so port
80 doesn't seem to be acting like a proxy by itself. Should I add some
proxy config in the modperl conf to deliberately set proxy=off?  (The
modperl port loads no proxy libs at all.)

Thanks for any pointers - this is really causing some problems.  Is
further info needed that can help diagnose this behavior?

vince


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] open proxy behavior problem

[Joshua Slive <jo...@slive.ca>]

On Mon, 9 Feb 2004, Vincent Kargatis wrote:
> I have an apache server (port 80) using mod_proxy pointing to a modperl
> port, the combo of which is acting like an open proxy even though I have
> ProxyRequests turned Off.

> RewriteRule ^/index.html http://%{HTTP_HOST}:8008/index.html [P]

Since the client can specify whatever they want in HTTP_HOST (in
particular, it doesn't need to match the host they are connecting to),
this is an open proxy.  Although it seems to me that it should only be
able to target hosts that have a server on port 8008.  Perhaps someone has
found a way around that, but I'd need to see more evidence to be sure.

> I see from
> http://www.mail-archive.com/dev@httpd.apache.org/msg17546.html that
> there seems to be a proposal for what I need, 'AllowHttpProxy', but
> that's as yet unimplemented, afaik.

No, that proposal doesn't do exactly what you want.  It limits the ports
which can be connected to, but not the hosts.

> I need the RewriteRule because I need to pass the (in my case)
> intentionally varying HTTP_HOST in the URL (well, at least, that's how
> it's currently coded).

You either need to hardcode the host in the rewriterule, or you need to
check the HTTP_HOST is within your network.  For example,

RewriteCond %{HTTP_HOST} .*\.mynetwork.example.com$
RewriteRule ^/index.html http://%{HTTP_HOST}:8008/index.html [P]

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org