NimbostratusHey Everyone, I am wondering if it is possible to modify the existing shellshock irule to log both source and destination IPs. I am sure there is but I am no TCL expert so any help would be appreciated.
when HTTP_REQUEST { if { [string match "() {;}" [HTTP::request]] } { log local0. "Detected CVE-2014-6271 attack from '[IP::client_addr]'; URI = '[HTTP::uri]'"; reject; } }
NimbostratusSo after much trial and error I think I got it. If anyone would like to try and validate that would be nice for anyone trying to do the same.
when HTTP_REQUEST { if { [string match "() {;}" [HTTP::request]] } { log local0. "Detected CVE-2014-6271 attack from '[IP::client_addr]'; destination '[IP::local_addr]'; URI = '[HTTP::uri]'"; reject; } }
CirrostratusChris,
I don't see any issues with what you've done but note the 'official' rule and the comments around it here: https://devcentral.f5.com/articles/shellshock-mitigation-with-big-ip-irules