Forum Discussion

idealo_security's avatar
idealo_security
Icon for Altostratus rankAltostratus
Mar 15, 2017

iRule to block paths is not working properly after decoding HTTP::uri

Hi folks, I was trying to generate an iRule which should take the URL, decode it, normalize the path portion and save it for later use in the following iRules. But unfortunately, I wasn't able to produce expected results. In the first iteration, it did not block anything. In the second iteration, it blocked everything (thanks to an error for undeclared variable 

$path
in 
set path [HTTP::path [URI::path $uri]]
). Now I'm still searching for a solution and would be happy if someone is able to suggest one.

I have made some comments in the iRule below to better grip what I was trying to accomplish.

first iRule to decode and normalize the path portion
when HTTP_REQUEST priority 400 {

     this part is taken from F5s DevCentral
    set tmpUri [HTTP::uri]
    set uri [URI::decode $tmpUri]

    while { $uri ne $tmpUri } {
       set tmpUri $uri
       set uri [URI::decode $tmpUri]
    }
     after decoding the URI in $uri we like to use only the decoded path
     later for decisions because if we pass the decoded query-string the application dies
     therfore: save the decoded path-portion of the URI in the HTTP::path-Variable
   HTTP::path [ URI::path $uri ]
    here I already tried to set it as a variable ("set $path ([HTTP::path [ URI::path $uri ]]))"
    but it didn't work out.
}

 second iRule separated to allow for other "pre-processing of input"
 this Rule matches against paths in a data group and if the request comes from internal
when HTTP_REQUEST priority 460 {
    using path because some query-params could have the same name as a path
    "block_url_status" is a data group with some paths to be blocked
   if {([ class match [ HTTP::path ] contains block_url_status ])}
   {
       check whether the request comes from internal networks
      if {(not [IP::addr [IP::client_addr] equals xx.xx.xx.xx ] ) }
        {
           HTTP::respond 404 content "File not found" noserver 
           event disable
        }
    }
}

Thank you everyone!

iRules
LTM
security
  • idealo_security's avatar
    idealo_security
    Mar 17, 2017

    Solution is found: The error was in not writing the basename back to the 

    HTTP:path
    variable:

    when HTTP_REQUEST priority 400 {
 this part is taken from F5s DevCentral
   set tmpUri [HTTP::uri]
   set uri [URI::decode $tmpUri]

   while { $uri ne $tmpUri } {
     set tmpUri $uri
     set uri [URI::decode $tmpUri]
   }
    set tmpPath "[URI::path $uri][URI::basename $uri]"
    HTTP::path $tmpPath 
}
  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Mar 15, 2017

    Have you tried using log local0. statement within the iRule in order to check what the incoming URI and the decoded version look like ? This might help to understand where the error exists.

     

  • idealo_security's avatar
    idealo_security
    Icon for Altostratus rankAltostratus
    Mar 17, 2017

    Solution is found: The error was in not writing the basename back to the 

    HTTP:path
    variable:

    when HTTP_REQUEST priority 400 {
 this part is taken from F5s DevCentral
   set tmpUri [HTTP::uri]
   set uri [URI::decode $tmpUri]

   while { $uri ne $tmpUri } {
     set tmpUri $uri
     set uri [URI::decode $tmpUri]
   }
    set tmpPath "[URI::path $uri][URI::basename $uri]"
    HTTP::path $tmpPath 
}