You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Tony Olekshy <ap...@olekshy.net> on 2025/02/24 18:32:47 UTC
[users@httpd] Why is our RewriteMap usage working for some URLs & not others?
Our Apache httpd.conf is configured to include these lines for
blocking requests from a list of IP addresses without logging
them — in this order and mixed with other lines — yet some such
requests are logged anyway:
CustomLog logs/access_log combined env=!DontLogIt
<VirtualHost *:80>
RewriteMap ipb "prg:/some-path/ip-block/filter"
RewriteCond ${ipb:%{REMOTE_ADDR}/%{HTTP_HOST}} X
RewriteRule ^ - [F,L,E=DontLogIt]
That ip-block/filter program writes to stdout, for each case of
request data Apache sends to its stdin, whether the request IP
address is on a block list, and this configuration successfully
blocks almost all the requests from those IP addresses — without
logging them.
However, some requests, such as the following, remain logged by
Apache even when they are from IP addresses in the block list,
and regardless of whether we have LogLevel set to info or warn:
/file%3a/////etc%2fpasswd%00
/%0d%0aSet-Cookie:crlfinjection=1;
/cgi-bin.%2e/.%2e/.%2e/.%2e/bin/sh
//%2f..=%5c..=%5c..=%5cetc%5cpasswd%00
Why is that happening, and what can we do to prevent logging of
those requests too, when they arrive from a blocked IP address?
Sincerely Yours
Tony Olekshy
apache@olekshy.net
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Why is our RewriteMap usage working for some URLs & not others?
Posted by Frank Gingras <th...@apache.org>.
On Mon, Feb 24, 2025 at 1:35 PM Tony Olekshy <ap...@olekshy.net> wrote:
> Our Apache httpd.conf is configured to include these lines for
> blocking requests from a list of IP addresses without logging
> them — in this order and mixed with other lines — yet some such
> requests are logged anyway:
>
> CustomLog logs/access_log combined env=!DontLogIt
>
> <VirtualHost *:80>
>
> RewriteMap ipb "prg:/some-path/ip-block/filter"
> RewriteCond ${ipb:%{REMOTE_ADDR}/%{HTTP_HOST}} X
> RewriteRule ^ - [F,L,E=DontLogIt]
>
> That ip-block/filter program writes to stdout, for each case of
> request data Apache sends to its stdin, whether the request IP
> address is on a block list, and this configuration successfully
> blocks almost all the requests from those IP addresses — without
> logging them.
>
> However, some requests, such as the following, remain logged by
> Apache even when they are from IP addresses in the block list,
> and regardless of whether we have LogLevel set to info or warn:
>
> /file%3a/////etc%2fpasswd%00
> /%0d%0aSet-Cookie:crlfinjection=1;
> /cgi-bin.%2e/.%2e/.%2e/.%2e/bin/sh
> //%2f..=%5c..=%5c..=%5cetc%5cpasswd%00
>
> Why is that happening, and what can we do to prevent logging of
> those requests too, when they arrive from a blocked IP address?
>
> Sincerely Yours
> Tony Olekshy
> apache@olekshy.net
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
Tony,
An IP block should not have issues with URL encoding - can you provide your
vhost configuration?
Re: [users@httpd] Why is our RewriteMap usage working for some URLs & not others?
Posted by Eric Covener <co...@gmail.com>.
> However, some requests, such as the following, remain logged by
> Apache even when they are from IP addresses in the block list,
> and regardless of whether we have LogLevel set to info or warn:
>
> /file%3a/////etc%2fpasswd%00
> /%0d%0aSet-Cookie:crlfinjection=1;
> /cgi-bin.%2e/.%2e/.%2e/.%2e/bin/sh
> //%2f..=%5c..=%5c..=%5cetc%5cpasswd%00
Maybe they are rejected so early that mod_rewrite is skipped? A quick
way to verify would be to set an environment variable in the same
stanza and log it too.
To resolve, you could invert the CustomLog and only log when an envvar
is set. Then flip the logic in the rewrite.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org