Repository: redis/redis

Issue:
[NEW] Peer address during "Possible SECURITY ATTACK detected"
**The problem/use-case that the feature addresses**

If Redis thinks an HTTP request comes its way, it will emit,

> Possible SECURITY ATTACK detected. It looks like somebody is sending POST or Host: commands to Redis. This is likely due to an attacker attempting to use Cross Protocol Scripting to compromise your Redis instance. Connection aborted.

**Description of the feature**

It would be useful to know what the peer's IP/port was, during this log, so that the offending connection can be tracked down, if necessary.

**Alternatives you've considered**

(N/A.)

**Additional information**

None.


Discussion:
@madolson do you think we should accept it? this may somehow like #11443
I think the suggestion makes sense.

Patch:
diff --git a/src/networking.c b/src/networking.c
index 7fa18af480c..58a41b364f1 100644
--- a/src/networking.c
+++ b/src/networking.c
@@ -3615,7 +3615,13 @@ void securityWarningCommand(client *c) {
     time_t now = time(NULL);
 
     if (llabs(now-logged_time) > 60) {
-        serverLog(LL_WARNING,"Possible SECURITY ATTACK detected. It looks like somebody is sending POST or Host: commands to Redis. This is likely due to an attacker attempting to use Cross Protocol Scripting to compromise your Redis instance. Connection aborted.");
+        char ip[NET_IP_STR_LEN];
+        int port;
+        if (connAddrPeerName(c->conn, ip, sizeof(ip), &port) == -1) {
+            serverLog(LL_WARNING,"Possible SECURITY ATTACK detected. It looks like somebody is sending POST or Host: commands to Redis. This is likely due to an attacker attempting to use Cross Protocol Scripting to compromise your Redis instance. Connection aborted.");
+        } else {
+            serverLog(LL_WARNING,"Possible SECURITY ATTACK detected. It looks like somebody is sending POST or Host: commands to Redis. This is likely due to an attacker attempting to use Cross Protocol Scripting to compromise your Redis instance. Connection from %s:%d aborted.", ip, port);
+        }
         logged_time = now;
     }
     freeClientAsync(c);