Forum Discussion

idealo_security's avatar
idealo_security
Icon for Altostratus rankAltostratus
Mar 15, 2017

iRule to block paths is not working properly after decoding HTTP::uri

Hi folks, I was trying to generate an iRule which should take the URL, decode it, normalize the path portion and save it for later use in the following iRules. But unfortunately, I wasn't able to produce expected results. In the first iteration, it did not block anything. In the second iteration, it blocked everything (thanks to an error for undeclared variable

$path
in
set path [HTTP::path [URI::path $uri]]
). Now I'm still searching for a solution and would be happy if someone is able to suggest one.

I have made some comments in the iRule below to better grip what I was trying to accomplish.

first iRule to decode and normalize the path portion
when HTTP_REQUEST priority 400 {

     this part is taken from F5s DevCentral
    set tmpUri [HTTP::uri]
    set uri [URI::decode $tmpUri]

    while { $uri ne $tmpUri } {
       set tmpUri $uri
       set uri [URI::decode $tmpUri]
    }
     after decoding the URI in $uri we like to use only the decoded path
     later for decisions because if we pass the decoded query-string the application dies
     therfore: save the decoded path-portion of the URI in the HTTP::path-Variable
   HTTP::path [ URI::path $uri ]
    here I already tried to set it as a variable ("set $path ([HTTP::path [ URI::path $uri ]]))"
    but it didn't work out.
}

 second iRule separated to allow for other "pre-processing of input"
 this Rule matches against paths in a data group and if the request comes from internal
when HTTP_REQUEST priority 460 {
    using path because some query-params could have the same name as a path
    "block_url_status" is a data group with some paths to be blocked
   if {([ class match [ HTTP::path ] contains block_url_status ])}
   {
       check whether the request comes from internal networks
      if {(not [IP::addr [IP::client_addr] equals xx.xx.xx.xx ] ) }
        {
           HTTP::respond 404 content "File not found" noserver 
           event disable
        }
    }
}

Thank you everyone!

  • Solution is found: The error was in not writing the basename back to the

    HTTP:path
    variable:

    when HTTP_REQUEST priority 400 {
     this part is taken from F5s DevCentral
       set tmpUri [HTTP::uri]
       set uri [URI::decode $tmpUri]
    
       while { $uri ne $tmpUri } {
         set tmpUri $uri
         set uri [URI::decode $tmpUri]
       }
        set tmpPath "[URI::path $uri][URI::basename $uri]"
        HTTP::path $tmpPath 
    }
    
  • Have you tried using log local0. statement within the iRule in order to check what the incoming URI and the decoded version look like ? This might help to understand where the error exists.

     

  • Solution is found: The error was in not writing the basename back to the

    HTTP:path
    variable:

    when HTTP_REQUEST priority 400 {
     this part is taken from F5s DevCentral
       set tmpUri [HTTP::uri]
       set uri [URI::decode $tmpUri]
    
       while { $uri ne $tmpUri } {
         set tmpUri $uri
         set uri [URI::decode $tmpUri]
       }
        set tmpPath "[URI::path $uri][URI::basename $uri]"
        HTTP::path $tmpPath 
    }