Custom App Signature to detect Firefox User Agent - not working on some https traffic

eschenburg — Mon, 14 Jul 2014 09:12:43 GMT

Hi,

recently I have been 'forced' through a support call to look into custom application signatures for the first time.

The requirement is to detect and block the Firefox UserAgent string (the usefulness of blocking something as easily spoofed like this at gateway level is not part of the problem )

The patterns were identified by the customer already and quickly verified by myself - we're looking Gecko/<some numbers> Firefox/<some number>0.00

The signature I've build will follow at the bottom.

The Problem:

The signature does not work for all https sites.

It works fine for all http sites which I've tested, and works also fine for *some https sites* (e.g. https://www.google.co.uk, https://www.bbc.co.uk).

But for others (e.g. https://www.facebook.com, https://www.linkedin.com) it does not (i.e. the website is displayed instead of blocked, based on the browser which is used (Firefox 30))

Needless to say, https inspection is enabled on my test device, certificate is imported into the browser etc.

Using fiddler, I have confirmed that the GET requests for those sites are looking identical compared to the ones where it is working.

Tested on PanOS 6.0.0 as well as 6.0.3

Anybody got any ideas?

Thanks!

Roland

The signature:

<application>

     <entry name="UserAgent_Firefox">

          <signature>

               <entry name="detect_firefox_userAgent">

                    <and-condition>

                         <entry name="And Condition 2">

                              <or-condition>

                                   <entry name="Or Condition 1">

                                        <operator>

                                             <pattern-match>

                                                  <qualifier>

                                                       <entry name="http-method">

                                                            <value>GET</value>

                                                       </entry>

                                                  </qualifier>

                                                  <pattern>\ Gecko/[0-9]*</pattern>

                                                  <context>http-req-headers</context>

                                             </pattern-match>

                                        </operator>

                                   </entry>

                              </or-condition>

                         </entry>

                         <entry name="And Condition 3">

                              <or-condition>

                                   <entry name="Or Condition 1">

                                        <operator>

                                             <pattern-match>

                                                  <qualifier>

                                                       <entry name="http-method">

                                                             <value>GET</value>

                                                       </entry>

                                                  </qualifier>

                                                  <pattern>Firefox/.0\.0</pattern>

                                                  <context>http-req-headers</context>

                                              </pattern-match>

                                        </operator>

                                   </entry>

                              </or-condition>

                         </entry>

                    </and-condition>

                    <scope>session</scope>

                    <order-free>no</order-free>

                </entry>

          </signature>

topic Custom App Signature to detect Firefox User Agent - not working on *some* https traffic in Automation/API Discussions

Custom App Signature to detect Firefox User Agent - not working on *some* https traffic

topic Custom App Signature to detect Firefox User Agent - not working on some https traffic in Automation/API Discussions

Custom App Signature to detect Firefox User Agent - not working on some https traffic