Forum Discussion
How can I skip ONLY Geolocation within ASM_REQUEST_VIOLATION if there is more than one Violation?
- Aug 01, 2019
UPDATE!!!!
when ASM_REQUEST_DONE {
if { [ASM::status] eq "blocked" } {
if { [class match [IP::client_addr] equals WHITELIST] && [ASM::violation names] equals "VIOLATION_ILLEGAL_GEOLOCATION" && [ASM::violation details] equals ""}{
log local0. "[ASM::violation_data]. [IP::client_addr] found in WHITELIST"
# log local0. "Violation count: [ASM::violation count] "
# log local0. "Violation names: [ASM::violation names] "
# log local0. "Violation attack types: [ASM::violation attack_types] "
log local0. "Violation details: [ASM::violation details] "
ASM::unblock
} else {
log local0. "[ASM::violation_data]. blocked for [IP::client_addr]"
}
}
}
if the ONLY Violation is Geolocation, then I continue. If there's anything else, I want to skip it. So NORMAL input on a web form is fine from a specific geolocation. Try and slip XSS, or SQL Injection, and it returns a System ID error. How can [ASM::violation count] returns 1 all the time, even though I've slipped some other violation into the form.
PLEASE NOTE; the ASM_REQUEST_DONE only works if ASM iRule setting is set to NORMAL. It will not fire in compatibility mode.
UPDATE!!!!
when ASM_REQUEST_DONE {
if { [ASM::status] eq "blocked" } {
if { [class match [IP::client_addr] equals WHITELIST] && [ASM::violation names] equals "VIOLATION_ILLEGAL_GEOLOCATION" && [ASM::violation details] equals ""}{
log local0. "[ASM::violation_data]. [IP::client_addr] found in WHITELIST"
# log local0. "Violation count: [ASM::violation count] "
# log local0. "Violation names: [ASM::violation names] "
# log local0. "Violation attack types: [ASM::violation attack_types] "
log local0. "Violation details: [ASM::violation details] "
ASM::unblock
} else {
log local0. "[ASM::violation_data]. blocked for [IP::client_addr]"
}
}
}
if the ONLY Violation is Geolocation, then I continue. If there's anything else, I want to skip it. So NORMAL input on a web form is fine from a specific geolocation. Try and slip XSS, or SQL Injection, and it returns a System ID error. How can [ASM::violation count] returns 1 all the time, even though I've slipped some other violation into the form.
PLEASE NOTE; the ASM_REQUEST_DONE only works if ASM iRule setting is set to NORMAL. It will not fire in compatibility mode.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com