You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by imacat <im...@mail.imacat.idv.tw> on 2007/03/19 10:00:16 UTC
[users@httpd] SSL access_log Flooded with "GET /" from 127.0.0.1 localhost
Dear all,
Hi. This is imacat from Taiwan.
After upgrading to Apache 2.2, the access_log of my SSL virtual host
is flooded with numerious these records:
...............
127.0.0.1 - - [19/Mar/2007:15:00:18 +0800] "GET /" 400 663
127.0.0.1 - - [19/Mar/2007:15:00:19 +0800] "GET /" 400 663
127.0.0.1 - - [19/Mar/2007:15:00:20 +0800] "GET /" 400 663
127.0.0.1 - - [19/Mar/2007:15:00:21 +0800] "GET /" 400 663
127.0.0.1 - - [19/Mar/2007:15:34:10 +0800] "GET /" 400 663
127.0.0.1 - - [19/Mar/2007:15:38:39 +0800] "GET /" 400 663
127.0.0.1 - - [19/Mar/2007:15:38:42 +0800] "GET /" 400 663
127.0.0.1 - - [19/Mar/2007:15:38:43 +0800] "GET /" 400 663
127.0.0.1 - - [19/Mar/2007:15:38:47 +0800] "GET /" 400 663
127.0.0.1 - - [19/Mar/2007:15:38:48 +0800] "GET /" 400 663
127.0.0.1 - - [19/Mar/2007:15:38:50 +0800] "GET /" 400 663
127.0.0.1 - - [19/Mar/2007:15:38:54 +0800] "GET /" 400 663
...............
I have searched the Apache 2.2 documentation, the Apache Users' list
and the Apache Developers' list and the Apache source files, and
confirmed that it is from modules/ssl/ssl_engine_io.c
ssl_io_filter_error(), as a result that the client make an HTTP request
on an HTTPS port.
However, I have two questions:
First, why does it need to do so, as making an internal request?
What will happen if it is not doing so? Couldn't it just return an HTTP
400 Bad Request response to the user?
The second and the most strange thing is that: Nobody is actually
make such an HTTP on HTTPS requst! Not only that this is our internal
server that no one outside can reach. If I make such an HTTP on HTTPS
request, I got the following result:
imacat@atlas ~ % lynx -dump http://172.16.168.195:443/
Bad Request
....
imacat@atlas ~ % tail -n 1 /var/log/apache/ssl/access_log
172.16.168.195 - - [19/Mar/2007:16:54:27 +0800] "GET /" 400 663 "-" "-"
"-" 172.16.168.195 __
imacat@atlas ~ %
Confirming that it logs my IP. So the line:
127.0.0.1 - - [19/Mar/2007:15:00:18 +0800] "GET /" 400 663
Must be from 127.0.0.1 localhost. But there is nothing checking the
host constantly on a wrong port on the host itself. Even if there is,
it can't possible be on all my Apache 2.2 hosts!
Could someone tell me what these internal requests from? Where can
I shut them down?
Thank you very much in your time in advance.
--
imacat ^_*'
imacat@mail.imacat.idv.tw
PGP Key: http://www.imacat.idv.tw/me/pgpkey.txt
Tavern IMACAT's http://www.imacat.idv.tw/
Woman's Voice http://www.wov.idv.tw/
TLUG List Manager http://www.linux.org.tw/mailman/listinfo/tlug
Re: [users@httpd] SSL access_log Flooded with "GET /" from 127.0.0.1 localhost
Posted by Joshua Slive <jo...@slive.ca>.
On 3/19/07, imacat <im...@mail.imacat.idv.tw> wrote:
> But it seems that ever since this discussing thread:
>
> [PATCH] Take 2, ssl_engine_io.c BIO and brigades refactored
> http://www.arcknowledge.com/gmane.comp.apache.devel/2002-10/msg00773.html
>
> The Apache developers seems to have changed from HTTP/1.0 to
> HTTP/0.9 simple request, which has no User-Agent header at all. That's
> why I can't identify it.
No, actually, I think it is just that since the request is not SSL, it
doesn't get read properly on the SSL vhost.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] SSL access_log Flooded with "GET /" from 127.0.0.1 localhost
Posted by imacat <im...@mail.imacat.idv.tw>.
On Mon, 19 Mar 2007 13:14:08 -0400
"Joshua Slive" <jo...@slive.ca> wrote:
> On 3/19/07, imacat <im...@mail.imacat.idv.tw> wrote:
> > Could someone tell me what these internal requests from? Where can
> > I shut them down?
> If you used extended-combined log format, you'd see from the
> User-Agent field that these requests are "Internal dummy conenctions"
> used by apache to manage its own processes. They can (and should) be
> safely ignored.
Oh, I see. Thank you for your hint.
I'm in fact logging the User-Agent. I simplified the logging format
for convienence of discussion. The real line I got is:
127.0.0.1 - - [20/Mar/2007:01:34:57 +0800] "GET /" 400 665 "-" "-"
You probally mean something like this:
127.0.0.1 - - [05/Feb/2007:16:05:27 +0800] "GET / HTTP/1.0" 200 263 "-"
"Apache/2.2.3 (Unix) DAV/2 PHP/5.1.6 (internal dummy connection)"
But it seems that ever since this discussing thread:
[PATCH] Take 2, ssl_engine_io.c BIO and brigades refactored
http://www.arcknowledge.com/gmane.comp.apache.devel/2002-10/msg00773.html
The Apache developers seems to have changed from HTTP/1.0 to
HTTP/0.9 simple request, which has no User-Agent header at all. That's
why I can't identify it.
Thank you for this hint. I'll look into this "internal dummy
connection". I have just made a simple web search. There seem to be
lots of discussion on this.
I hope this could be added to the Apache FAQ or the source code
comment. It really kills me looking for this answer.
--
Best regards,
imacat ^_*' <im...@mail.imacat.idv.tw>
PGP Key: http://www.imacat.idv.tw/me/pgpkey.txt
<<Woman's Voice>> News: http://www.wov.idv.tw/
Tavern IMACAT's: http://www.imacat.idv.tw/
TLUG List Manager: http://lists.linux.org.tw/cgi-bin/mailman/listinfo/tlug
Re: [users@httpd] SSL access_log Flooded with "GET /" from 127.0.0.1 localhost
Posted by Joshua Slive <jo...@slive.ca>.
On 3/19/07, imacat <im...@mail.imacat.idv.tw> wrote:
> First, why does it need to do so, as making an internal request?
> What will happen if it is not doing so? Couldn't it just return an HTTP
> 400 Bad Request response to the user?
>
> The second and the most strange thing is that: Nobody is actually
> make such an HTTP on HTTPS requst! Not only that this is our internal
> server that no one outside can reach. If I make such an HTTP on HTTPS
> request, I got the following result:
> Could someone tell me what these internal requests from? Where can
> I shut them down?
If you used extended-combined log format, you'd see from the
User-Agent field that these requests are "Internal dummy conenctions"
used by apache to manage its own processes. They can (and should) be
safely ignored.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org