# SPDX-License-Identifier: AGPL-3.0-only
# Someone testing whether this server will relay their traffic:
#   "GET http://example.com/ HTTP/1.1"
#   "CONNECT example.com:443 HTTP/1.1"
#
# A browser sends an absolute URL only to a configured proxy. Arriving
# at a web server for a host we do not serve it means one thing, and
# the people who send it are looking for somewhere to launder an
# attack from. (The requested URL is captured as `path`, NEVER as
# `target`: target is the reserved field for the site a hit is about,
# and the open-proxy rule leans on its absence.)
parser: http-open-proxy
log: http
prefilter: "://"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[a-zA-Z][a-zA-Z0-9+.-]*://[^ "]*) [^"]*" (?P<status>\d{3}) \S+ "[^"]*" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx
