Questions[blackhole](server)

I'm developing an app using CakePHP and have encountered a strange problem: When I POST data to a particular method I get a 0 byte response and a simple 404 error in the access log.

psycho953.psych.susx.ac.uk - - [11/Oct/2011:10:17:43 +0100] "GET /research/ssd/aesthetics/participants/add HTTP/1.1" 200 3255 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"
psycho953.psych.susx.ac.uk - - [11/Oct/2011:10:17:44 +0100] "POST /research/ssd/aesthetics/participants/add HTTP/1.1" 404 - "http://webvm.psych.sussex.ac.uk/research/ssd/aesthetics/participants/add" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"

POSTing to other forms works, whether or not they use CakePHP or just regular PHP.

I can't figure out how to work beyond the 0 byte response. My question isn't so much "Why isn't this working?" as "How can I find out what's not working?"

For the record, php.ini is set to display errors and succeeds in doing so for syntax errors etc.

I have a private network with a handful of Linux routers all route sharing via OSPF. How do I blackhole private network ranges that I don't have routes for?

In other words, I want to be sure I NEVER route 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/24 out to the default gateway. I can't just create static sink (blackhole) routes for these networks as a network within one of the private ranges may get advertised via OSPF.

I could use netfilter to just DROP all traffic going out the default GW connected interface if its in a private range, but I figured iproute2/linux might have had a simpler or more 'correct' solution.

From some networks requesting certain images on our webserver is very flakey. I've looked at tcpdumps on both sides and the server sends back part of the file and the client ACKs the TCP packet but the server never receives the ACK.

The servers view:

41  19.941136   212.169.34.114  209.20.73.85    TCP 52456 > http [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2
42  19.941136   209.20.73.85    212.169.34.114  TCP http > 52456 [SYN, ACK] Seq=0 Ack=1 Win=5440 Len=0 MSS=1360
46  20.041142   212.169.34.114  209.20.73.85    TCP 52456 > http [ACK] Seq=1 Ack=1 Win=65280 Len=0
47  20.045142   212.169.34.114  209.20.73.85    HTTP    GET /map/map/s+74-WBkWk0aR28Yy-YjXA== HTTP/1.1
48  20.045142   209.20.73.85    212.169.34.114  TCP http > 52456 [ACK] Seq=1 Ack=522 Win=6432 Len=0
49  20.045142   209.20.73.85    212.169.34.114  TCP [TCP segment of a reassembled PDU] (Part of the content of the image 2720 bytes. i assume it is reassembled in tcpdump and it is fragmented over the wire.)
** never receives the ACK sent in frame 282 and will eventually resend the tcp segment **

The clients view:

274 26.161773   10.0.16.67  209.20.73.85    TCP 52456 > http [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2
276 26.262867   209.20.73.85    10.0.16.67  TCP http > 52456 [SYN, ACK] Seq=0 Ack=1 Win=5440 Len=0 MSS=1360
277 26.263255   10.0.16.67  209.20.73.85    TCP 52456 > http [ACK] Seq=1 Ack=1 Win=65280 Len=0
278 26.265193   10.0.16.67  209.20.73.85    HTTP    GET /map/map/s+74-WBkWk0aR28Yy-YjXA== HTTP/1.1 
279 26.365562   209.20.73.85    10.0.16.67  TCP http > 52456 [ACK] Seq=1 Ack=522 Win=6432 Len=0
280 26.368002   209.20.73.85    10.0.16.67  TCP [TCP segment of a reassembled PDU] (Part of the content of the image. Only 1400 bytes.)
282 26.571380   10.0.16.67  209.20.73.85    TCP 52456 > http [ACK] Seq=522 Ack=1361 Win=65280 Len=0

The network we are having trouble with is NATd. Is there any kind of explanation for this weirdness?

I’m exhausted. I just spent the last two hours chasing a goose that I have been after on-and-off for the past year. Here is the goal, put as succinctly as possible.

Step 1: HOSTS File:

127.0.0.5 NastyAdServer.com
127.0.0.5 xssServer.com
127.0.0.5 SQLInjector.com
127.0.0.5 PornAds.com
127.0.0.5 OtherBadSites.com
…

Step 2: Apache httpd.conf

<VirtualHost 127.0.0.5:80>
    ServerName BlackHole
    DocumentRoot "X:\Docs\…\BlackHole"
    RewriteEngine On
    RewriteRule (\.(gif|jpg|png|jpeg)$) /p.png [L]
    RewriteRule (.*) /ad.htm [L]
</VirtualHost>

So basically what happens is that the HOSTS file redirects designated domains to the localhost, but to a specific loopback IP address. Apache listens for any requests on this address and serves either a transparent pixel graphic, or else an empty HTML file. Thus, any page or graphic on any of the bad sites is replaced with nothing (in other words an ad/malware/porn/etc. blocker).


This works great as is (and has been for me for years now). The problem is that these bad things are no longer limited to just HTTP traffic. For example:

<script src="http://NastyAdServer.com:99">
or
<iframe src="https://PornAds.com/ad.html">
or a Trojan using
ftp://spammaster.com/[email protected];[email protected];[email protected]
or an app “phoning home” with private info in a crafted ICMP packet by pinging
CardStealer.ru:99

Handling HTTPS is a relatively minor bump. I can create a separate VirtualHost just like the one above, replacing port 80 with 443, and adding in SSL directives. This leaves the other ports to be dealt with.

I tried using * for the port, but then I get overlap errors. I tried redirecting all request to the HTTPS server and visa-versa but neither worked; either the SSL requests wouldn’t redirect correctly or else the HTTP requests gave the You’re speaking plain HTTP to an SSL-enabled server port… error. Further, I cannot figure out a way to test if other ports are being successfully redirected (I could try using a browser, but what about FTP, ICMP, etc.?)


I realize that I could just use a port-blocker (eg ProtoWall, PeerBlock, etc.), but there’s two issues with that. First, I am blocking domains with this method, not IP addresses, so to use a port-blocker, I would have to get each and every domain’s IP, and update theme frequently. Second, using this method, I can have Apache keep logs of all the ad/malware/spam/etc. requests for future analysis (my current BlackHole logs are already 466MB right now).

I appreciate any help in successfully setting up an Apache VirtualHost blackhole. Thanks.

Currently running BIND on RHEL 5.4 and am looking for a more efficient manner of providing DNS redirection to a honeypot server for a large (30,000+) list of forbidden domains.

Our current solution for this requirement is to include a file containing a zone master declaration for each blocked domain in named.conf. Subsequently, each of these zone declarations point to the same zone file, which resolves all hosts in that domain to our honeypot servers. ...basically this allows us to capture any "phone home" attempts by malware that may infiltrate the internal systems.

The problem with this configuration is the large amount of time taken to load all 30,000+ domains as well as management of the domain list configuration file itself... if any errors creep into this file, the BIND server will fail to start, thereby making automation of the process a little frightening. So I'm looking for something more efficient and potentially less error prone.

named.conf entry:

include "blackholes.conf";

blackholes.conf entry example:

zone "bad-domain.com" IN { type master; file "/var/named/blackhole.zone"; allow-query { any; }; notify no; };

blackhole.zone entries:

$INCLUDE std.soa

@ NS ns1.ourdomain.com.
@ NS ns2.ourdomain.com.
@ NS ns3.ourdomain.com.

                       IN            A                192.168.0.99
*                      IN            A                192.168.0.99