AltostratusWe have implemented ASM recently and one request was blocked because of content length being 0. Checked with application team and as per them that shouldn't be blocked. Is there a way to exclude a URL from this check or is it only global? Please suggest
It seems to be a global setting. I couldn't find a way within the configuration utility to make an exception. But you could use an iRule to create an exception. See the iRule below.
when ASM_REQUEST_DONE {
set uri [HTTP::uri]
foreach violation [ASM::violation names] {
if { $uri starts_with "/login.php" && [ASM::violation count] < 2 } {
if { [matchclass [ASM::violation attack_types] equals "ATTACK_TYPE_HTTP_REQUEST_SMUGGLING_ATTACK"] } {
log local0. "Violation $violation detected for URI $uri, but allowed anyway."
ASM::unblock
}
} else {
# More than one violation, too dangerous to Unblock
return
}
}
}
AltostratusThank you for your guidance. Would this have any performance impact?
What is violation count? Is it occurrences within a time frame?
Can you share attack type codes so tha I can reuse code for other compliance blocks as well?
Thanks in advance.
Every iRule would have some kind of impact on performane, but I can't tell you what the impact will be. If you want to find out, take a look at this article: https://devcentral.f5.com/s/articles/irules-optimization-101-05-evaluating-irule-performance
The violation count returns the number of violations found in the request. One HTTP request could trigger multiple violations. So if more violations are triggered for the same request, you'll probably want to block this and investigate the issue.
For a list of attack codes, see this link: https://clouddocs.f5.com/api/irules/ASM__violation_data.html
It's also good to know that the configuration utility gives hints on what to look for. See the example below.
AltostratusWhat about 'Header 'If-None-Match' has no value'?
Something like this:
when ASM_REQUEST_DONE {
set uri [HTTP::uri]
foreach violation [ASM::violation names] {
if { $uri starts_with "/login.php" && [ASM::violation count] < 2 } {
foreach attack [ASM::violation attack_types] {
switch $attack {
"ATTACK_TYPE_HTTP_REQUEST_SMUGGLING_ATTACK" -
"ATTACK_TYPE_HTTP_PARSER_ATTACK" {
log local0. "Violation: $violation and attack: $attack detected for URI $uri, but allowed anyway."
ASM::unblock
}
}
}
} else {
# More than one violation, too dangerous to Unblock
return
}
}
}BTW, this is the way to test with curl if you want to send an empty HTTP header:
curl -v http://10.23.98.101/login.php -H "If-None-Match;"
Did you enable the 'Trigger ASM iRule Events' in your security policy? It's in the advanced settings.