Forum Discussion

sathish_2826's avatar
sathish_2826
Icon for Nimbostratus rankNimbostratus
Jan 03, 2020

Security headers irule issue

Hi there, i have been trying to apply an Irule to block requests for a URL when the domain is other than the ones allowed in the below rule,

 

when HTTP_REQUEST {

  switch -glob [HTTP::header "Referer"]|[HTTP::header "Origin"]|[HTTP::header "X-Forwarded-Host"] {

   

                "xxxx.net" -

   

                "xxxx.com" 

 

pool emx-pool

        }

default { HTTP::respond 200 content "

<HTML>

<HEAD>

<TITLE>Rejected Request</TITLE>

</HEAD>

<BODY>The request was rejected. <BR>The server is trying to redirect the client to an external site, but it is forbidden</BODY>

</HTML>"

}

}

}

 

=========================

 

The issue is, even when i am part of xxxx.net domain, i am not being sent to the default pool and keeps on hitting the rejected message body, can someone review this please?

application delivery
BIG-IP
iRules

4 Replies

Sort By
  • Yoann_Le_Corvi1's avatar
    Yoann_Le_Corvi1
    Icon for Cumulonimbus rankCumulonimbus
    Jan 03, 2020

    Hi

     

    I do not this  switch -glob synthax is correct (with | to match any of the headers). You will probable have to use if, or to concatenate the thress headers before you do your comarison, taking care of input validation as thos can be altered by the client.

     

    If I have a few minutes this afternoon, I'll try to provide you a detailed solution.

     

    Yoann

  • Yoann_Le_Corvi1's avatar
    Yoann_Le_Corvi1
    Icon for Cumulonimbus rankCumulonimbus
    Jan 03, 2020

    Hopefully this does the trick 🙂

    when HTTP_REQUEST {
 
set domains { "xxxx.net" "xxxx.com" }
set matched 0
 
foreach header { "Referer" "Origin" "X-Forwarded-Host" } {
log local0. "$header - [HTTP::header $header] : [lsearch -exact $domains [HTTP::header $header]]"
    if { ! ( [lsearch -exact $domains [HTTP::header $header]] equals "-1" ) } {
        incr matched
    }
 
}
 
if { $matched > 0 } {
    pool emx-pool
} else {
    HTTP::respond 200 content "
 
<HTML>
 
<HEAD>
 
<TITLE>Rejected Request</TITLE>
 
</HEAD>
 
<BODY>The request was rejected. <BR>The server is trying to redirect the client to an external site, but it is forbidden</BODY>
 
</HTML>"
 
    
}
 
 
}
  • sathish_2826's avatar
    sathish_2826
    Icon for Nimbostratus rankNimbostratus
    Jan 06, 2020

    Thank you Yoann for your response, i tested the rule and it is still hitting the else part and returning the body content,

     

    One more thing i would like to highlight is, the domain for the URL is (test.xxx.net & test.xxx.com), in the rule, we are referencing the base domain (xxx.net & xxx.com), is this an issue, please take a look.