Bypassing ASM on HTTP response

Question

Is it possible to prevent ASM from blocking responses when there's a specific HTTP header present in the HTTP response? Let's say we block responses with HTTP status code 500 by default in our security policies, but is it possible to circumvent the ASM from blocking when the status code is 500 AND Content-Type = "application/problem-handled-return-to-client"? If possible, I'd like this to be generic so I can reuse the same solution in different VS's without changing code.

sanjayp · Accepted Answer

Try with an iRule. use appropriate asm policy name. Use logging to see if condition is getting triggered and then it can be disabled. when HTTP_RESPONSE  {
ASM::enable "/common/asm_policy"
if { ([HTTP::status] == 500) and ([HTTP::header value Content-Type] eq "application/problem-handled-return-to-client") }{
log local0.info "disable asm"
ASM::disable
return
   }
}

yiğit_uslu · Answer

Can't call after responding means most probably an event overlap is occurring. Checkout if there is another rule or policy attached to VS with HTTP_RESPONSE event.

If so, combine both HTTP_RESPONSE event content in one iRule.

Hope this helps

eljay · Answer

Thanks for your answer, &nbsp;.&nbsp;I read about the HTTP_RESPONSE event in the F5 docs, https://clouddocs.f5.com/api/irules/HTTP_RESPONSE.html, but ASM::disable isn't mentioned as an available command. Is this command list complete?&nbsp;I also wonder, is it possible to extract ASM policy name from the HTTP_REQUEST? It makes it easier to make a generic iRule.

sanjayp · Answer

ASM::disable is valid command in HTTP_RESPONSE event.

If you want to use generic one, you can remove ASM::enable command at the start of the iRule and test it ASM gets enabled in the response for every and all subsequent events after a match. But F5 recommends to enable it before disabling for specific traffic.

eljay · Answer

Something isn't working as expected. I use this simple code which I cut and pasted from https://clouddocs.f5.com/api/irules/HTTP_RESPONSE.html and made only a small change inside the IF-statement :when HTTP_RESPONSE {
&nbsp;
  if { [HTTP::status] contains "500"} {
     log local0.debug "HTTP_RESPONSE - err: 500"
  }
&nbsp;
}But when I make a request that triggers a 500 status code then I get this message in the LTM log:&nbsp;&lt;date removed&gt; &lt;host removed&gt; err tmm[14816]: 01220001:3: TCL error: /Common/asm-override &lt;HTTP_RESPONSE&gt; - Can't call after responding - ERR_NOT_SUPPORTED (line 1)&nbsp;&nbsp;&nbsp;invoked from within "HTTP::status"&nbsp;We are using v15.1.2.1 with an Eng Hotfix.&nbsp;

eljay · Answer

&nbsp;Thank you! When I browsed through the other iRules, then I found an iRule that was executed before this one. Thanks a lot! 🙂&nbsp;

Forum Discussion

Bypassing ASM on HTTP response

7 Replies

Recent Discussions

Chrome V 124+ on MacOS - Virtual Server Access Issue

vulnerabilities (CVE-2020-36363), CVE-2016-0736,CVE-2019-6593-FOR VERSION BIGIP LTM-16.1.4

Port Group on F5OS network setting

Advise on setting up IRULE

F5 iRule to replace host to path

Related Content

iRule to take cookie from HTTP Response into HTTP Request via table

Introduction of Incident Response

Unique Identifier for irules Http response

custom response page for api

FIX Message Response