topic Re: HTTP XFF header not being removed in R80.10 in Firewall and Security Management

HTTP XFF header not being removed in R80.10

Kaspars_Zibarts — Fri, 24 Aug 2018 09:43:30 GMT

In case someone else was using SK How to enable stripping of X-Forward-For (XFF) field

I know that it worked perfectly OK in R70.30 and we never bothered checking it after upgrades to R80.10, just assumed it worked. Today just by pure chance I stumbled across the fact that our internal IPs are being sent out in XFF header that were supposed to be stripped out.

One thing that I noticed with R80.10 is that kernel parameter ws_remove_proxy_connection_header doesn't seem to work anymore

Anyone else could verify this?

SR submitted

Re: HTTP XFF header not being removed in R80.10

PhoneBoy — Fri, 24 Aug 2018 11:16:36 GMT

Since the SK says it's relevant for R80.10, it's probably worth a TAC case to investigate.

Re: HTTP XFF header not being removed in R80.10

G_W_Albrecht — Fri, 24 Aug 2018 12:22:03 GMT

The sk speaks about two procedures (depending on the IA blade) to enable this, one in Dashboard and one in GUIdbEdit. Then we find the comment: It has been observed that XFF stripping may still not function, even if all the above steps are performed correctly, when the value of kernel parameter 'ws_remove_proxy_connection_header' is set to 0 (zero).

It say : May !

Re: HTTP XFF header not being removed in R80.10

Kaspars_Zibarts — Fri, 24 Aug 2018 12:25:52 GMT

That's why I added the screenshot - it does not recognise the parameter we were able to set/get it in R77.30

Re: HTTP XFF header not being removed in R80.10

PhoneBoy — Fri, 24 Aug 2018 16:47:51 GMT

Thus why I think a TAC case is needed to investigate.

Re: HTTP XFF header not being removed in R80.10

Kaspars_Zibarts — Fri, 24 Aug 2018 17:59:48 GMT

Yep, as mentioned in original post - case lodged and all logs provided. Time for weekend. Hopefully it's fixed when I return on Monday morning

Re: HTTP XFF header not being removed in R80.10

Kaspars_Zibarts — Tue, 04 Sep 2018 06:09:12 GMT

Hard to admit but it was proper Homer situation.. Forgot that we ad turned off AntiBot blade few months ago and you need one of medium path blades to be active for XFF removal to work

Re: HTTP XFF header not being removed in R80.10

PhoneBoy — Tue, 04 Sep 2018 14:25:35 GMT

Yep, that will definitely do it.

Re: HTTP XFF header not being removed in R80.10

Kaspars_Zibarts — Tue, 04 Sep 2018 15:29:55 GMT

You meant bang myself on the head? haha yep!