Custom App for CRL downloads

cancel
Showing results for 
Search instead for 
Did you mean: 

Custom App for CRL downloads

L1 Bithead

Hi,

I am trying to create a custom app that will match CRL downloads, to allow them without any questions ask. Shouldn't be too hard : on a previous web security gateway, I would match a pattern like the following: "http://([^/:])*crl.*\.crl"

When translated to an app signature, I already know I am looking for two patterns, on the following contexts:

  • http-req-host-header
  • http-req-uri-path

Now, my issue is that my pattern are incredibly simple. I am not able to reach the 7 bytes limit with this. One other way would be to match the MIME type in the RSP header I guess... application/pkix-crl or application/x-pkcs7-crl are fine. The issue is with the occasional misconfigured root CAs that still reports text/plain.

So....  Is there anything I can do with this to simply allow CRLs without creating a huge custom category?

Thank you.

20 REPLIES 20

I've removed the rsp section, and only used the GET http-req-headers.   The match specified in the above article does not work.    It's not the rsp section that is the problem, it is the initial http-req-headers pattern match.  What did you do to get the first match working?  

 

In the packet captures taken on the firewall it appears there is a /r/n at the end of the request.   Does wireshark add these in, or is this something literally being read by the firewall?

 

Everything else has been removed except the 1st http-request header, method get:

 

.*\.crl HTTP.*\r\n  will match

.*\.crl HTTP.* does not match

.*\.crl\sHTTP.*  does not match

 

 

<application version="9.1.0">
  <entry name="APP_CRL_VAL">
    <signature>
      <entry name="GET CRL File">
        <and-condition>
          <entry name="And Condition 1">
            <or-condition>
              <entry name="Or Condition 1">
                <operator>
                  <pattern-match>
                    <qualifier>
                      <entry name="http-method">
                        <value>GET</value>
                      </entry>
                    </qualifier>
                    <pattern>.*\.crl HTTP.*User\-Agent.*</pattern>
                    <context>http-req-headers</context>
                  </pattern-match>
                </operator>
              </entry>
            </or-condition>
          </entry>
          <entry name="And Condition 2">
            <or-condition>
              <entry name="Or Condition 1">
                <operator>
                  <pattern-match>
                    <pattern>((application/pkix-crl)|(application/x-pkcs7-crl)|(text/plain)|(application/octet-stream)).*</pattern>
                    <context>http-rsp-headers</context>
                  </pattern-match>
                </operator>
              </entry>
            </or-condition>
          </entry>
        </and-condition>
        <scope>session</scope>
        <order-free>no</order-free>
      </entry>
    </signature>
    <subcategory>infrastructure</subcategory>
    <category>networking</category>
    <technology>client-server</technology>
    <description>matches CRL download</description>
    <risk>2</risk>
    <evasive-behavior>no</evasive-behavior>
    <consume-big-bandwidth>no</consume-big-bandwidth>
    <used-by-malware>no</used-by-malware>
    <able-to-transfer-file>no</able-to-transfer-file>
    <has-known-vulnerability>yes</has-known-vulnerability>
    <tunnel-other-application>no</tunnel-other-application>
    <tunnel-applications>no</tunnel-applications>
    <prone-to-misuse>no</prone-to-misuse>
    <pervasive-use>no</pervasive-use>
    <file-type-ident>no</file-type-ident>
    <virus-ident>no</virus-ident>
    <data-ident>no</data-ident>
    <default>
      <port>
        <member>tcp/80</member>
      </port>
    </default>
  </entry>
</application>

This is the app that I got to work and added a 3rd way that I found within the wireshark traces.

But again, this is my first attempt on getting anything working with a custom PAN app-id and I used the base application provided within this Post. Without that I wouldn't have even known where to begin.

 

Feel free to try it out and maybe/hopefully you find a flaw or something. I wouldn't be surprised if there is something odd in there.

Cheers

 

There's no home like 127.0.0.1

I must have been doing something wrong, as I'm getting matches off of this now.   Thank you for the quick reply.   Appears to be working!

 

Still not sure why the  below will create a match.   I udnerstand the http.*    But the User\-Agent directly after it doesn't make sense.  Unless the firewall is taking "any" of these patterns and making a match against what it sees?   

HTTP.*User\-Agent.*


A request I see in a browsers appears to look like:

GET /pkiops/crl/MicCodSigPCA2011_2011-07-08.crl HTTP/1.1

 

there is only a User-Agent listed as a separate request header:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
But it must check any of these fields?

Hi There

To be honest the User Agent part was already in there.
I just took the app, tried it..... tried to so what wireshark says/shows and searched some documents on how the string should look.

if I recall correctly there is only a difference was pattern matching and changing it to "session" instead of "protocol-data-unit" after that it worked and I added the case for "application/octet-stream" since I found some CRL Pages sending it like that.

I don't know or do much with custom App-ID so maybe someone else can weigh in on it.

 

Regards

Alex

 

 

There's no home like 127.0.0.1

I'm not sure on this, but it looks like octet-stream, might be a fallback for an unknown.   BTW-Changing to session did the trick.   Makes sense as to why "transaction" wouldn't match this no matter what I was adding.   It almost looks as though the firewall wasn't reading that HTTP response.  Even though the below post seems to say otherwise:

https://live.paloaltonetworks.com/t5/general-topics/transaction-and-session-of-signature-scope/td-p/... 

Hi There

 

So are you running the app successfully now in your environment?

I have it deployed on a larger scale now and so far if i add a URL filterping profile with alert for all alloed categories I do see only *.crl files in the URL log hitting. But in traffic Log I have a lot more hits (to the same public IPs) then what I have in the URL log.

 

Regards

Alex

There's no home like 127.0.0.1

Yes, appears to be working ok for us.

L0 Member

I wonder if even the latest version can do that?

L2 Linker

Hi Hebejena

 

How do you mean "if the latest version can do that" do you mean if there is a app-id or a built in way from Palo Alto to cover this use-case with their latest PAN-OS releases? 

Regards

Alex

There's no home like 127.0.0.1

That would be ideal really.  Something that would cover all .crl cases.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!