topic Re: Creating a custom app signature to block by URL path in Custom Signatures

Creating a custom app signature to block by URL path

svintinner — Thu, 25 Oct 2018 22:40:49 GMT

I'm hoping to get some help with a custom signature that I've created. We're trying to block users from playing flash games on facebook, but still allow them to get to everything else. For example: https://apps.facebook.com/candycrush. The URL category is social-networking and the application is facebook-apps.

I've created a signature to detect the app as follows:

 facebook-candycrush {
     subcategory gaming;
     category media;
     technology browser-based;
     risk 2;
     data-ident no;
     parent-app facebook-apps;
     default {
         port tcp/443;
     }
     signature {
         facebook-candycrush-url {
             and-condition {
                 "And Condition 1" {
                     or-condition {
                         "Or Condition 1" {
                             operator {
                                 pattern-match {
                                     pattern apps\.facebook\.com;
                                     context http-req-host-header;
                                 }
                             }
                         }
                     }
                 }
                 "And Condition 2" {
                     or-condition {
                         "Or Condition 1" {
                             operator {
                                 pattern-match {
                                     pattern candycrush;
                                     context http-req-uri-path;
                                 }
                             }
                         }
                     }
                 }
             }
             scope protocol-data-unit;
             order-free no;
             comment "Detect apps.facebook.com/candycrush";
         }
     }

Picture of the GUI config:

I'm missing something with the AND syntax. It works fine if I only look for the http-req-host-header or if I only look for the http-req-uri-path, but when I add both, it doesn't work.

Any help would be appreciated.

Re: Creating a custom app signature to block by URL path

svintinner — Fri, 26 Oct 2018 15:26:38 GMT

Solved my problem by changing from transaction to session and removing ordered condition match.

Re: Creating a custom app signature to block by URL path

Raido_Rattameister — Tue, 13 Nov 2018 12:28:54 GMT

Why don't you use custom url category and block this category with security profile?

Re: Creating a custom app signature to block by URL path

svintinner — Tue, 13 Nov 2018 21:23:27 GMT

Well that would certainly be easier. I guess I was under the impression that URL Categories only worked on hostnames or domains, not paths.

Re: Creating a custom app signature to block by URL path

Raido_Rattameister — Tue, 13 Nov 2018 21:26:14 GMT

You can use path. For example permit single Youtube video.

Re: Creating a custom app signature to block by URL path

svintinner — Tue, 13 Nov 2018 21:27:00 GMT

I just tested and of course it works perfectly. Thanks so much for setting me straight.