idealo_security
Mar 15, 2017Altostratus
iRule to block paths is not working properly after decoding HTTP::uri
Hi folks, I was trying to generate an iRule which should take the URL, decode it, normalize the path portion and save it for later use in the following iRules. But unfortunately, I wasn't able to produce expected results. In the first iteration, it did not block anything. In the second iteration, it blocked everything (thanks to an error for undeclared variable
$path
in set path [HTTP::path [URI::path $uri]]
). Now I'm still searching for a solution and would be happy if someone is able to suggest one.
I have made some comments in the iRule below to better grip what I was trying to accomplish.
first iRule to decode and normalize the path portion
when HTTP_REQUEST priority 400 {
this part is taken from F5s DevCentral
set tmpUri [HTTP::uri]
set uri [URI::decode $tmpUri]
while { $uri ne $tmpUri } {
set tmpUri $uri
set uri [URI::decode $tmpUri]
}
after decoding the URI in $uri we like to use only the decoded path
later for decisions because if we pass the decoded query-string the application dies
therfore: save the decoded path-portion of the URI in the HTTP::path-Variable
HTTP::path [ URI::path $uri ]
here I already tried to set it as a variable ("set $path ([HTTP::path [ URI::path $uri ]]))"
but it didn't work out.
}
second iRule separated to allow for other "pre-processing of input"
this Rule matches against paths in a data group and if the request comes from internal
when HTTP_REQUEST priority 460 {
using path because some query-params could have the same name as a path
"block_url_status" is a data group with some paths to be blocked
if {([ class match [ HTTP::path ] contains block_url_status ])}
{
check whether the request comes from internal networks
if {(not [IP::addr [IP::client_addr] equals xx.xx.xx.xx ] ) }
{
HTTP::respond 404 content "File not found" noserver
event disable
}
}
}
Thank you everyone!
Solution is found: The error was in not writing the basename back to the
variable:HTTP:path
when HTTP_REQUEST priority 400 { this part is taken from F5s DevCentral set tmpUri [HTTP::uri] set uri [URI::decode $tmpUri] while { $uri ne $tmpUri } { set tmpUri $uri set uri [URI::decode $tmpUri] } set tmpPath "[URI::path $uri][URI::basename $uri]" HTTP::path $tmpPath }