Forum Discussion

smalex's avatar
smalex
Icon for Altostratus rankAltostratus
Jun 12, 2019

HTTP Compliance Exception

We have implemented ASM recently and one request was blocked because of content length being 0. Checked with application team and as per them that shouldn't be blocked. Is there a way to exclude a URL from this check or is it only global? Please suggest

application delivery
ASM Advanced WAF
security
  • Niels_van_Sluis's avatar
    Niels_van_Sluis
    Icon for MVP rankMVP
    Jun 12, 2019

    It seems to be a global setting. I couldn't find a way within the configuration utility to make an exception. But you could use an iRule to create an exception. See the iRule below.

    when ASM_REQUEST_DONE {
  set uri [HTTP::uri]
  foreach violation [ASM::violation names] {
      if { $uri starts_with "/login.php" && [ASM::violation count] < 2 } {
          if { [matchclass [ASM::violation attack_types] equals "ATTACK_TYPE_HTTP_REQUEST_SMUGGLING_ATTACK"] } {
              log local0. "Violation $violation detected for URI $uri, but allowed anyway."
              ASM::unblock
          }
      } else {
          # More than one violation, too dangerous to Unblock
          return
      }
  }
}
  • smalex's avatar
    smalex
    Icon for Altostratus rankAltostratus
    Jun 12, 2019

    Thank you for your guidance. Would this have any performance impact?

     

    What is violation count? Is it occurrences within a time frame?

     

    Can you share attack type codes so tha I can reuse code for other compliance blocks as well?

     

     

    Thanks in advance.

  • Niels_van_Sluis's avatar
    Niels_van_Sluis
    Icon for MVP rankMVP
    Jun 12, 2019

    Every iRule would have some kind of impact on performane, but I can't tell you what the impact will be. If you want to find out, take a look at this article: https://devcentral.f5.com/s/articles/irules-optimization-101-05-evaluating-irule-performance

     

    The violation count returns the number of violations found in the request. One HTTP request could trigger multiple violations. So if more violations are triggered for the same request, you'll probably want to block this and investigate the issue.

     

    For a list of attack codes, see this link: https://clouddocs.f5.com/api/irules/ASM__violation_data.html

     

    It's also good to know that the configuration utility gives hints on what to look for. See the example below.

     

     

     

     

     

    • Niels_van_Sluis's avatar
      Niels_van_Sluis
      Icon for MVP rankMVP
      Jun 12, 2019

      Something like this:

      when ASM_REQUEST_DONE {
  set uri [HTTP::uri]
  foreach violation [ASM::violation names] {
      if { $uri starts_with "/login.php" && [ASM::violation count] < 2 } {
          foreach attack [ASM::violation attack_types] {
              switch $attack {
                  "ATTACK_TYPE_HTTP_REQUEST_SMUGGLING_ATTACK" -
                  "ATTACK_TYPE_HTTP_PARSER_ATTACK" {
                      log local0. "Violation: $violation and attack: $attack detected for URI $uri, but allowed anyway."
                      ASM::unblock
                  }
              }
          }
      } else {
          # More than one violation, too dangerous to Unblock
          return
      }
  }
}

      BTW, this is the way to test with curl if you want to send an empty HTTP header:

      curl -v http://10.23.98.101/login.php -H "If-None-Match;"

      • Niels_van_Sluis's avatar
        Niels_van_Sluis
        Icon for MVP rankMVP
        Jun 13, 2019

        Did you enable the 'Trigger ASM iRule Events' in your security policy? It's in the advanced settings.