Hi,
recently I have been 'forced' through a support call to look into custom application signatures for the first time.
The requirement is to detect and block the Firefox UserAgent string (the usefulness of blocking something as easily spoofed like this at gateway level is not part of the problem 
)
The patterns were identified by the customer already and quickly verified by myself - we're looking Gecko/<some numbers> Firefox/<some number>0.00
The signature I've build will follow at the bottom.
The Problem:
The signature does not work for all https sites.
It works fine for all http sites which I've tested, and works also fine for *some https sites* (e.g. https://www.google.co.uk, https://www.bbc.co.uk).
But for others (e.g. https://www.facebook.com, https://www.linkedin.com) it does not (i.e. the website is displayed instead of blocked, based on the browser which is used (Firefox 30))
Needless to say, https inspection is enabled on my test device, certificate is imported into the browser etc.
Using fiddler, I have confirmed that the GET requests for those sites are looking identical compared to the ones where it is working.
Tested on PanOS 6.0.0 as well as 6.0.3
Anybody got any ideas?
Thanks!
Roland
The signature:
<application>
<entry name="UserAgent_Firefox">
<signature>
<entry name="detect_firefox_userAgent">
<and-condition>
<entry name="And Condition 2">
<or-condition>
<entry name="Or Condition 1">
<operator>
<pattern-match>
<qualifier>
<entry name="http-method">
<value>GET</value>
</entry>
</qualifier>
<pattern>\ Gecko/[0-9]*</pattern>
<context>http-req-headers</context>
</pattern-match>
</operator>
</entry>
</or-condition>
</entry>
<entry name="And Condition 3">
<or-condition>
<entry name="Or Condition 1">
<operator>
<pattern-match>
<qualifier>
<entry name="http-method">
<value>GET</value>
</entry>
</qualifier>
<pattern>Firefox/.0\.0</pattern>
<context>http-req-headers</context>
</pattern-match>
</operator>
</entry>
</or-condition>
</entry>
</and-condition>
<scope>session</scope>
<order-free>no</order-free>
</entry>
</signature>
