Forum Discussion

Chen_Zhe's avatar
Chen_Zhe
Icon for Altostratus rankAltostratus
Jul 09, 2020

base on HTTP header irules to blocked request

Hi,

Demand background：

Each request must contain at least one of the four header （has configed at Application Security : Headers : HTTP Headers）

access-token

authentication

authorization

token

my bad rules:

if { [HTTP::host] == "abc.com" || [HTTP::host] == "123.biz" } {

  if {[class match [HTTP::uri] contains meeting] and [ASM::violation names] eq "VIOLATION_MISSING_MANDATORY_HEADER" and [llength [ASM::violation details]] < 12} {

  ASM::unblock

   log local0.info "[HTTP::host] [HTTP::uri] and [llength [ASM::violation details]] and [ASM::violation details] and [ASM::violation names]"

  }

}

 

log output:

Rule /Common/authentication_header_url_check <ASM_REQUEST_DONE>: 

abc.biz 

/dealerUser/auth/login and 5 and {viol_index 64} {viol_name VIOL_MANDATORY_HEADER} {header_data.header_name access-token} {header_data.header_name authentication} 

{header_data.header_name token} and 

VIOLATION_MISSING_MANDATORY_HEADER

It based on violation names number,Cannot match actual demand。 who has good idea,thanks a lot.

ASM Advanced WAF
iRules
security

4 Replies

Sort By
  • Ivan_Chernenkii's avatar
    Ivan_Chernenkii
    Icon for Employee rankEmployee
    Jul 10, 2020

    Hello Chen Zhe,

     

    What are you trying to achieve? If you want to block all requests which don't contains any of these 4 headers, then it would be better just create such rule in iRule or you can create attack signature with such rule (e.g content:!"access-token"; nocase; content:!"authentication"; nocase;....)

     

    Thanks, Ivan

    • Chen_Zhe's avatar
      Chen_Zhe
      Icon for Altostratus rankAltostratus
      Jul 13, 2020

      Hi Ivan,

      thank you!

      Achieve you guess is right,detail: block all request which don't contains any of these 4 headers,unless shome HOST or host+uri .

      but,rules didn't work as I expected。

      when hit whilelist fist,at the end rules it hit discard again.​

       

      when HTTP_REQUEST {

       if {[HTTP::header exists token] or [HTTP::header exists access-token] or [HTTP::header exists authentication] or [HTTP::header exists authorization]}{

         ASM::enable "/Common/base-on-header-string"

       }

      #following all fuction is whitelist.

      if { [class match [HTTP::host] contains domain_whiltlist] } {

       ASM::enable "/Common/base-on-header-string"

       }

       if { [HTTP::host] == "meetingroomip-uat.bba-app.com" || [HTTP::host] == "meeting-inspection.bba-app.biz" } {

         if {[class match [HTTP::uri] contains meeting] } {

         ASM::enable "/Common/base-on-header-string"

        }

       }

       if { [HTTP::host] == "bestyou-uat.bba-app.com" || [HTTP::host] == "bestyou.bba-app.biz" } {

         if { [class match [HTTP::uri] contains bestyou] } {

         ASM::enable "/Common/base-on-header-string"

        }

       }

      else{

      discard

      }

      ​

      • Ivan_Chernenkii's avatar
        Ivan_Chernenkii
        Icon for Employee rankEmployee
        Jul 13, 2020

        I didn't get your further "whitelist" part...

        Do you want not enforce in case of whitelist?.. then you need ASM: disable.

        Also, you have

        when HTTP_REQUEST {

         if {[HTTP::header exists token] or [HTTP::header exists access-token] or [HTTP::header exists authentication] or [HTTP::header exists authorization]}{

           ASM::enable "/Common/base-on-header-string"

         }

        which means apply ASM policy in case of at least one header exists... While AFAIU you didn't want to block it. Please, clarify.