Unverified Commit f3e16a1a authored by Binbin's avatar Binbin Committed by GitHub
Browse files

Print IP and port on Possible SECURITY ATTACK detected (#12024)

Add a print statement to indicate which IP/port is sending the attack. So that the offending connection can be tracked
down, if necessary.
parent 810ea67b
...@@ -3615,7 +3615,13 @@ void securityWarningCommand(client *c) { ...@@ -3615,7 +3615,13 @@ void securityWarningCommand(client *c) {
time_t now = time(NULL); time_t now = time(NULL);
if (llabs(now-logged_time) > 60) { if (llabs(now-logged_time) > 60) {
serverLog(LL_WARNING,"Possible SECURITY ATTACK detected. It looks like somebody is sending POST or Host: commands to Redis. This is likely due to an attacker attempting to use Cross Protocol Scripting to compromise your Redis instance. Connection aborted."); char ip[NET_IP_STR_LEN];
int port;
if (connAddrPeerName(c->conn, ip, sizeof(ip), &port) == -1) {
serverLog(LL_WARNING,"Possible SECURITY ATTACK detected. It looks like somebody is sending POST or Host: commands to Redis. This is likely due to an attacker attempting to use Cross Protocol Scripting to compromise your Redis instance. Connection aborted.");
} else {
serverLog(LL_WARNING,"Possible SECURITY ATTACK detected. It looks like somebody is sending POST or Host: commands to Redis. This is likely due to an attacker attempting to use Cross Protocol Scripting to compromise your Redis instance. Connection from %s:%d aborted.", ip, port);
}
logged_time = now; logged_time = now;
} }
freeClientAsync(c); freeClientAsync(c);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment