<div dir="ltr"><div>Hi Justin!</div><div><br></div><div>What do you mean by "blocking" those requests? As you can see from the logs, thye don't even reach vcl_recv before they are thrown out, so they are technically already being rejected.</div><div><br></div><div>Kind regards,</div><div><br></div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>-- <br></div><div>Guillaume Quintard<br></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jul 15, 2024 at 9:44 AM Justin Lloyd <<a href="mailto:justinl@arena.net">justinl@arena.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg502924234521796411">
<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="m_502924234521796411WordSection1">
<p class="MsoNormal">Hi all,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’m trying to figure out what the requests are that are resulting in the following Varnish responses and how to block them:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">* << Request >> 39071654
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">- Begin req 39071653 rxreq<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">- Timestamp Start: 1721059686.537197 0.000000 0.000000<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">- Timestamp Req: 1721059686.537197 0.000000 0.000000<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">- BogoHeader Illegal char 0x20 in header name<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">- HttpGarbage "GET%00"<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">- RespProtocol HTTP/1.1<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">- RespStatus 400<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">- RespReason Bad Request<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">- ReqAcct 535 0 535 28 0 28<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">- End<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">These are on AWS EC2 instances that are behind an Application Load Balancer (ALB) that is connected to a Web Application Firewall (WAF), so in theory I should be able to figure out a rule to add to the WAF to block these. I’d just need
to get more information to do so, and AWS support could probably help, but I wanted to check here first if there’s any way to get further information about such requests out of Varnish.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">FWIW, the 0x20 is a space character, but there are also similar requests reporting 0x09 (horizontal tab) characters.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
<p class="MsoNormal">Justin<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
_______________________________________________<br>
varnish-misc mailing list<br>
<a href="mailto:varnish-misc@varnish-cache.org" target="_blank">varnish-misc@varnish-cache.org</a><br>
<a href="https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc" rel="noreferrer" target="_blank">https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc</a><br>
</div></blockquote></div>