Re: Matching URLs at layer 7

From: Benedikt Fraunhofer <fraunhof#traced.net>
Date: Wed, 28 Apr 2010 19:16:17 +0200


Hi *,

> (2) Host header is www.example.com
> (3) All is good! Pass request on to server.
> (2) Host header is www.whatever.com
> (3) All is NOT good! Flick request somewhere harmless.

If that's all you want, you should be able to go with

 acl xxx_host hdr(Host) -i xxx.example.com  block if !xxx_host

, in your listen(, ...) section. But everything comes with a downside: IMHO HTTP/1.0 doesnt require the Host header to be set so you'll be effecitvely lock out all the HTTP/1.0 users unless you make another rule checking for an undefined Host header (and allowing that) (or checking for HTTP/1.0, there should be a "macro" for that.

Just my 2cent
  Beni. Received on 2010/04/28 19:16

This archive was generated by hypermail 2.2.0 : 2010/04/28 19:30 CEST