Requests that cause 301 redirects do not write a location response header when IP is not found within the cache

[Nydauron]

Repro steps

• Ensure mod_crowdsec and rewrite mods are enabled
• Have a redirect rule within apache's config (e.g. Redirect /test /)
• Start up apache
• Send an HTTP request to the path where the redirect is located (e.g. http://127.0.0.1/test)

Note that this issue is not present when another page that gives back a response of 200 is requested first, then the redirect request due to the cache containing the crowdsec decision for the IP. Restarting apache wipes the cache and it can be observed the problem reoccurs if the first request right after is to a redirect URL.

Expected behavior

A 301 response is received with a Location header for browsers to redirect to.

Actual behavior

A 301 response is received, but no Location header is present.

The Problem

The problem stems from line 384 where the main request investigation status code check on the main request is made. Since the request results in a 3xx status response, it fails this check and propagates upward without checking crowdsec.

cs-apache2-bouncer/mod_crowdsec.c

Lines 381 to 389 in 27dfea4

	/* create a proxy request */
	rr = ap_sub_req_method_uri("GET", r->uri, r, NULL);
	if (rr->status != HTTP_OK) {
	ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r,
	"crowdsec: service '%s' returned %d, request rejected: %s",
	target, rr->status, r->uri);
	return rr->status;
	}

Possible Solutions

1. Allow redirect status codes (and also 1xx and 2xx status codes) to proxy a decision check to the LAPI.
2. If the main request investigation status code returns a 3xx status code, exit out, but also propagate the Location header to the main request r.
3. Allow all requests, regardless of the investigation status code, to send a decision check to the LAPI.

I think 1 and 2 are both viable, but between the two, I'm wondering if serving a redirection page to banned IPs is necessary.

[Nexulo]

There seems to be a bigger problem with redirect 301.
In my example, the redirect from /folder to /folder/ does not work either. The "Location" is missing for the redirect.

If I set DirectorySlash Off in my .htaccess and do the redirect via RewriteRule ^folder$ %{REQUEST_URI}/ [L,R=301], it works as it should.