deis/deis — pull request #2063 by aledbf (2014-10-08 15:59:58+00:00)
Title: feat(router): include a firewall to mitigate security problems.

When the firewall is enabled a request to any router trying to exploit shellshock like this will return the error code 400 (this can be changed):

```console
curl -v -k -H 'User-Agent: () { :;}; echo aa>/tmp/aa' http://172.17.8.100/index.html
* About to connect() to 172.17.8.100 port 80 (#0)
* Trying 172.17.8.100...
* Connected to localhost (172.17.8.100) port 80 (#0)
> GET /index.html HTTP/1.1
> Host: 172.17.8.100
> Accept: */*
> User-Agent: () { :;}; echo aa>/tmp/aa
>
< HTTP/1.1 400
* Server nginx/1.6.2 is not blacklisted
< Server: nginx/1.6.2
< Date: Tue, 30 Sep 2014 16:46:48 GMT
< Content-Length: 0
< Connection: keep-alive
<
* Connection #0 to host localhost left intact
```

error log
```console
2014/09/30 13:46:48 [error] 12665#0: *1 NAXSI_FMT: ip=127.0.0.1&server=172.17.8.100&uri=/index.html&learning=0&vers=0.53-1&total_processed=1&total_blocked=1&block=1&cscore0=$ATTACK&score0=8&zone0=HEADERS&id0=42000393&var_name0=user-agent, client: 172.17.8.102, server: localhost, request: "GET /index.html HTTP/1.1", host: "localhost"
```