I would love to say that all URLs are created equal but that is not always the case. The same could be said about applying a security policy. Sometimes the logic behind one URL needs to be completely different. With the power of ASM + iRules, we can kick that logic up a notch.
when RULE_INIT {
# Friends don't let friends log in production.
# Logging off=0, Logging on =1
set static::DEBUG_LEVEL 0
}
when BOTDEFENSE_ACTION {
if {[HTTP::uri] ends_with "/faq"} {
if { $static::DEBUG_LEVEL == 1} {
log local0.alert "Allowed [HTTP::header User-Agent] to access [HTTP::uri]"
log local0.alert "*************************************"
log local0.alert ""
log local0.alert "" }
BOTDEFENSE::cs_allowed true
set res [BOTDEFENSE::action allow]
}
# EXAMPLE 2: Instead of blocking the request with TCP RST, respond with a
# blocking-page
if {[BOTDEFENSE::action] eq "tcp_rst" and [HTTP::uri] eq "/bloc_page_test" } {
# if the custom_response action fails, the tcp_rst action will remain,
# so we don't need to check the return string in this case
BOTDEFENSE::action custom_response "sorry\ni am blocking you again\n"
}
if {not (([BOTDEFENSE::action] eq "allow") && ([BOTDEFENSE::reason] eq "valid cookie; no need to renew"))}
{
if { $static::DEBUG_LEVEL == 1} {
log local0.alert "Got request from IP [IP::client_addr]"
log local0.alert "UA is [HTTP::header User-Agent]"
log local0.alert "Bot action is [BOTDEFENSE::action] because [BOTDEFENSE::reason]"
log local0.alert "DeviceID is [BOTDEFENSE::device_id]"
log local0.alert "*************************************"
log local0.alert ""
log local0.alert ""}
}
# EXAMPLE: Send a CAPTCHA challenge on the login page, and only allow the
# login if the user passed the CAPTCHA challenge
if {[BOTDEFENSE::action] eq "allow"} {
if {[BOTDEFENSE::captcha_status] ne "correct"} {
if {[HTTP::uri] eq "/user/login"} {
set res [BOTDEFENSE::action captcha_challenge]
if {$res ne "ok"} {
if { $static::DEBUG_LEVEL == 1} {
log local0. "cannot send captcha_challenge: \"$res\"" }
BOTDEFENSE::action tcp_rst
}
} elseif {[HTTP::uri] eq "/user/login"} {
set res [BOTDEFENSE::action custom_response {
login failed because you may not be human
}]
if {$res ne "ok"} {
if { $static::DEBUG_LEVEL == 1} {
log local0. "cannot send blocking page: \"$res\"" }
BOTDEFENSE::action tcp_rst
}
}
}
}
}
As you can see, the power of iRules we can make decisions based on the following:
- URI
- DeviceID
- TCP RST OR DROP
- CAPTCHA
And that’s just how we do it at F5, stop the bad guys and look good doing it.
Best Regards,
BD