Forum Discussion
jondyke_46152
Nimbostratus
NimbostratusIrule for restriciting URL paths unsecure
I currenlty use an irule that I use to restrict traffic to certain paths:-
when HTTP_REQUEST {
if {([matchclass [HTTP::uri] starts_with $::securePaths]) and not ([matchclass [IP::client_addr] equals $::trustedAddresses])}{
log local0. "Untrusted IP ([IP::client_addr]) attempting to access secure path ([HTTP::uri])"
discard
} else {
log local0. "Allowing connection from [IP::client_addr] to [HTTP::uri]"
}
}
However I have just discovered that the paths I have in the data group appear to be case sensitive so \test\ as a restricted path can be circumvented by using \Test\. How do I get around this? I don't wish to add every possible path upper and lower case to the datagroup - I will be here until next Christmas!
13 Replies
jondyke_46152Thanks Colin - that works (is misssing a closing} though)
Unfortunatley it does net get around the /// issue. If you put more than one slash before the path i.e. //resticted/ it lets you in....
Not sure how to get round that one really.- You could always change the equals in the HTTP::path matchclass to a contains, as long as nothing that shouldn't be restricted contains the paths you're storing in your class. That should account for the //. It's not a precise workaround, but it should work.
Colin 
hoolioCirrostratus
I think it's a bit of a losing battle to try to handle all the encoding/obfuscation methods in an iRule...
Here are a few examples of ways to encode a request for Microsoft's default page:
original
http://www.microsoft.com/en/us/default.aspx
multiple forward slashes
http://www.microsoft.com/en/us/////default.aspx
multiple back slashes
http://www.microsoft.com/en/us\\\default.aspx
request containing a white listed string
http://www.microsoft.com/en/us/white_listed_string/../default.aspx
hex encoding of "default"
http://www.microsoft.com/en/us/%64%65%66%61%75%6C%74.aspx
hex encoded backslashes
http://www.microsoft.com/en/us%5C%5C%5Cdefault.aspx
Here is an interesting article describing these and other encoding methods:
URL Embedded Attacks
http://www.technicalinfo.net/papers/URLEmbeddedAttacks.html
Aaron
