Technical Forum
Ask questions. Discover Answers.
cancel
Showing results for 
Search instead for 
Did you mean: 
Custom Alert Banner

ASM::unblock not working for specific violation

F5Audiolomb
Altostratus
Altostratus

Hello there,
I set an iRule for ASM that should unblock a specific violation:

 

when ASM_REQUEST_DONE {
    set asm_support_id [ASM::support_id]
    if { $uri starts_with "/my/uri" and [ASM::violation names] contains "VIOL_ENCODING" } then {
        ASM::unblock
    }
}

 

This rule is not triggered for that specific violation. What am I missing?
I would also like to point out that if I remove the second part of the IF and leave just the uri match, the rule triggers just fine.

I am 100% sure the violation I am targeting is correct.

Any clues on what is wrong with it?

Thank you!

6 REPLIES 6

Add logging and check it.

log local0. [ASM::violation names]

You are right as there are subviolations so the real name could be different. Still can't renember where I saw the real name with  ASM::violation details or ASM::violation_data or the command you shared.

Have you set the variable $uri value before checking its content?

set uri [string tolower [HTTP::uri]] 

 As @Juergen_Mang mentioned, logging both [HTTP::uri] and [ASM::violation names] can help a lot

Yes I did.

I just pasted the snippet I am interested in. Please assume that the rest is in place.

Thank you for helping with this!

T-Trust
MVP
MVP

please log below for confirm

when ASM_REQUEST_DONE {

log local0. "HTTP URI: $uri VIOLATION: [ASM::violation names]"
set asm_support_id [ASM::support_id]
if { $uri starts_with "/my/uri" and [ASM::violation names] contains "VIOL_ENCODING" } then {
ASM::unblock
}
}

F5Audiolomb
Altostratus
Altostratus

Well... thank you all for your inputs. I logged the violation, and it turns out the violation name is "VIOLATION_CHAR_CONV".

Where is that name coming from, I wonder? If I go to options->application security->advanced configuration->violation list, the violation name I see is the one I specified in my code above.

So, at this point I am completely confused. The violation names in the GUI all start with VIOL_, while the violation names logged via the irule start with VIOLATION_, hence why my irule was not working.

Why this discrepancy? All this does not make any sense to me.
If the violation names in the GUI don't match with what I need to use in the iRules, how the heck am I supposed to find what names to use?
BTW, I am on version 15.1.10.2.