mod-security-users

[mod-security-users] HTTP_REFERER

[Andras G. <an...@an...>]

Hi,

I have a rule (i had actually) HTTP_REFERER that i renamed HTTP_HTTP_REFERER, because simply 
HTTP_REFERER searched in the whole header. I only need to ban some referers (forums actually), where 
links posted which cause a DoS to the server. It's a free webhosting service. :) The question is 
which rule is the correct? :)

P.S: Ivan I would do the translation of mod_sec 1.9 as we emailed earlier. :) Is the HTML version 
ready for this?

Thx,
Andrej

Re: [mod-security-users] HTTP_REFERER

[Ivan R. <iv...@we...>]

Andras Got wrote:
> Hi,
> 
> I have a rule (i had actually) HTTP_REFERER that i renamed
> HTTP_HTTP_REFERER, because simply HTTP_REFERER searched in the whole
> header. I only need to ban some referers (forums actually), where links
> posted which cause a DoS to the server. It's a free webhosting service.
> :) The question is which rule is the correct? :)

  Why don't you post the rule and we'll tell you :)
  (I don't see how HTTP_HTTP_REFERER could work though.)


> P.S: Ivan I would do the translation of mod_sec 1.9 as we emailed
> earlier. :) Is the HTML version ready for this?

  It is. If you do it in DocBook, though, I will be able to produce
  PDF, single-page HTML, and multi-page HTML all at once.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] HTTP_REFERER

[Ivan R. <iv...@we...>]

Andras Got wrote:
> 
> SecFilterSelective "HTTP_REFERER"
> "(dakolbass|techmusic|fairlight|warez|forum|sg\.hu)"

  This will inspect the Referer header looking for those keywords.


> And now HTTP_HTTP_REFERER.

  Won't do anything.


> I followed this: HTTP_header – search request
> header "header".

  Right, but the header name is "Referer". Henece HTTP_Referer.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] HTTP_REFERER

[Achim H. <ki...@se...>]

On Fri, 18 Nov 2005, Ivan Ristic wrote:

!! > And now HTTP_HTTP_REFERER.
!!
!!   Won't do anything.
!!
!!
!! > I followed this: HTTP_header =E2=80=93 search request
!! > header "header".
!!
!!   Right, but the header name is "Referer". Henece HTTP_Referer.


dooh, this brings up following question:
 what if the HTTP header is really named   REFERER: blabla

Does this mean that mod_security only accepts the "recommended" upper-,
lower-case spelling according RFC?
(I mean matching the header, not mod_security's HTTP_<header> keywords)

Achim

Re: [mod-security-users] HTTP_REFERER

[Ivan R. <iv...@we...>]

Achim Hoffmann wrote:
> On Fri, 18 Nov 2005, Ivan Ristic wrote:
> 
> !! > And now HTTP_HTTP_REFERER.
> !!
> !!   Won't do anything.
> !!
> !!
> !! > I followed this: HTTP_header � search request
> !! > header "header".
> !!
> !!   Right, but the header name is "Referer". Henece HTTP_Referer.
> 
> dooh, this brings up following question:
>  what if the HTTP header is really named   REFERER: blabla
> 
> Does this mean that mod_security only accepts the "recommended" upper-,
> lower-case spelling according RFC?
> (I mean matching the header, not mod_security's HTTP_<header> keywords)

  ModSecurity ignores case so you are fine either way. (This will be
  configurable in the future.)

  I just like to write the header names/variable names/cookie names
  in lowercase to lessen the chance of confusion.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org