ABE blocks local server

Discussions about the Application Boundaries Enforcer (ABE) module
hag

ABE blocks local server

Post by hag »

I've been having some trouble with ABE on my local network. I've got a workaround in place for it, styled after other suggestions here, but I'm still wondering what the underlying issue is. I haven't found deeper clues, and the workaround strikes me as that -- a workaround.

If I'm using an IPv4 machine or otherwise force things to IPv4, the app in question works fine. If I'm using a more typical dual stack machine around here, web site traffic goes via IPv6, and fails with an error message along the lines of:
Request {POST http://www.mysite.com/page <<< http://www.mysite.com/page, http://www.mysite.com/page - 6} filtered by ABE: <LOCAL> Deny

Any clues as to what's going on here? The v6 setup here is a pretty vanilla dual stack setup, and I can't imagine that inserting custom rules into ABE is the way this is supposed to work.

Thanks!
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
Trillian

Re: ABE blocks local server

Post by Trillian »

Here too, seems that NoScript does not know about IPV6 (yet??? :?: ) and does not consider those addresses as LOCAL too.

So far I could only turn off ABE completly, but the real annoying thing is that it even blocks our internal start page, so I even cannot inform the users to turn off ABE, instead I have to walk from office to office.... :shock:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0
dhouwn
Bug Buster
Posts: 968
Joined: Thu Mar 19, 2009 12:51 pm

Re: ABE blocks local server

Post by dhouwn »

If your "internal start page" is on the Intranet, i.e. in a non-routable range, then it counts as LOCAL.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0
User avatar
Giorgio Maone
Site Admin
Posts: 9524
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: ABE blocks local server

Post by Giorgio Maone »

Trillian wrote:Here too, seems that NoScript does not know about IPV6 (yet??? :?: )
It does. Could you please paste here the exact message(s) you get from ABE?
Mozilla/5.0 (Windows NT 5.2; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3369
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: ABE blocks local server

Post by GµårÐïåñ »

Many of my concerns with your post are expressed by dhouwn and Girogio; however, I would like to add the option that, if you have a specific and preferably static address for those local (intranet) servers, then you can add a very specific exemption for them in the SYSTEM rule before the LOCAL rule is triggered and that will prevent any future issues.

So, if you are aware of the local intranet address of your server like dhouwn explained, or if you have exact information of the message so that we can see the exact address like Giorgio asked, then we can construct a rule that will expose the functionality of those servers for your specific situation while still keeping the LOCAL protection rule intact for everything else.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/6.9 (en-US; rv:6.9.6.9) Gecko/66666666 Firefox/6.6.6
User avatar
Giorgio Maone
Site Admin
Posts: 9524
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: ABE blocks local server

Post by Giorgio Maone »

GµårÐïåñ wrote:, I would like to add the option that, if you have a specific and preferably static address for those local (intranet) servers, then you can add a very specific exemption for them in the SYSTEM rule before the LOCAL rule is triggered and that will prevent any future issues.
There are actually two ways to do this: either appending the extra origins to the "Accept from LOCAL" line in the SYSTEM ruleset, or inserting them in the noscript.ABE.localExtras about:config preferences.
Mozilla/5.0 (Windows NT 5.2; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3369
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: ABE blocks local server

Post by GµårÐïåñ »

Giorgio Maone wrote:There are actually two ways to do this: either appending the extra origins to the "Accept from LOCAL" line in the SYSTEM ruleset, or inserting them in the noscript.ABE.localExtras about:config preferences.
There you have it, thank you for adding that clarification.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/6.9 (en-US; rv:6.9.6.9) Gecko/66666666 Firefox/6.6.6
Guest

Re: ABE blocks local server

Post by Guest »

Hi, I'm having a similar issue, and would like some help constructing a workaround. I downloaded Bitnami and am running Wordpress natively. When I try to open http://localhost:8080/wordpress/wp-admin/ I get the following error:
Request {GET http://localhost:8080/wordpress/wp-admin/ <<<http//protopage.com/empress_of_the_universe#Untitled/Home - 6} filtered by ABE: <LOCAL> Deny

When I disable the System settings in ABE, I am able to open the page. Can I get some help in what to paste in the System box to allow localhost:8080?

Thanks,
Elizabeth
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:6.0.2) Gecko/20100101 Firefox/6.0.2
User avatar
Giorgio Maone
Site Admin
Posts: 9524
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: ABE blocks local server

Post by Giorgio Maone »

Guest wrote: When I disable the System settings in ABE, I am able to open the page. Can I get some help in what to paste in the System box to allow localhost:8080?
In the very beginning (top) of the SYSTEM ruleset, put this rule:

Code: Select all

Site localhost:8080
Accept
Mozilla/5.0 (Windows NT 5.2; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3369
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: ABE blocks local server

Post by GµårÐïåñ »

Guest wrote:Hi, I'm having a similar issue, and would like some help constructing a workaround. I downloaded Bitnami and am running Wordpress natively. When I try to open http://localhost:8080/wordpress/wp-admin/ I get the following error:
Request {GET http://localhost:8080/wordpress/wp-admin/ <<<http//protopage.com/empress_of_the_universe#Untitled/Home - 6} filtered by ABE: <LOCAL> Deny

When I disable the System settings in ABE, I am able to open the page. Can I get some help in what to paste in the System box to allow localhost:8080?

Thanks,
Elizabeth
Elizabeth, at first glance it looks like you are locally working on a copy of wordpress but you have configured it with the actual domain it will properly reside on later. So what is happening is that the LOCAL is triggered legitimately as its trying to access an outside address.

In the simplest term, if you add the following to the ABE section -> SYSTEM -> ABOVE the current LOCAL rule the following, it SHOULD work just fine:

<solution removed in favor of Giorgio's solution>

it should fix your problem, but if I am wrong, Giorgio please correct, thank you.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3369
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: ABE blocks local server

Post by GµårÐïåñ »

Well, while I was writing my reply Giorgio posted his, so please go ahead and use his as it seems to be simpler and probably will work in a wider set of cases.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0
Guest

Re: ABE blocks local server

Post by Guest »

Thanks, Giorgio's solution worked. I don't understand this code (I don't even know what it's called) but it may have been more complicated than it looked because Protopage is my home page of links, though I'm not sure why that would have showed up in the error code. I tried the solution with Protopage, but that didn't work--I don't get errors going from my home page to links normally.

I don't know if it matters, but when I first installed Bitnami and Wordpress, it worked fine, no errors. When I rebooted my computer, the servers stopped and I needed to restart them. Then I was getting the the NoScript problem. That's more of an FYI, though. Everything's back to working and I'm happy. Thanks again for the speedy assistance.

Elizabeth
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:6.0.2) Gecko/20100101 Firefox/6.0.2
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3369
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: ABE blocks local server

Post by GµårÐïåñ »

You are welcome, glad it worked.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0
Post Reply