I am trying to create a custom app that will match CRL downloads, to allow them without any questions ask. Shouldn't be too hard : on a previous web security gateway, I would match a pattern like the following: "http://([^/:])*crl.*\.crl"
When translated to an app signature, I already know I am looking for two patterns, on the following contexts:
Now, my issue is that my pattern are incredibly simple. I am not able to reach the 7 bytes limit with this. One other way would be to match the MIME type in the RSP header I guess... application/pkix-crl or application/x-pkcs7-crl are fine. The issue is with the occasional misconfigured root CAs that still reports text/plain.
So.... Is there anything I can do with this to simply allow CRLs without creating a huge custom category?
I've removed the rsp section, and only used the GET http-req-headers. The match specified in the above article does not work. It's not the rsp section that is the problem, it is the initial http-req-headers pattern match. What did you do to get the first match working?
In the packet captures taken on the firewall it appears there is a /r/n at the end of the request. Does wireshark add these in, or is this something literally being read by the firewall?
Everything else has been removed except the 1st http-request header, method get:
.*\.crl HTTP.*\r\n will match
.*\.crl HTTP.* does not match
.*\.crl\sHTTP.* does not match
<application version="9.1.0"> <entry name="APP_CRL_VAL"> <signature> <entry name="GET CRL File"> <and-condition> <entry name="And Condition 1"> <or-condition> <entry name="Or Condition 1"> <operator> <pattern-match> <qualifier> <entry name="http-method"> <value>GET</value> </entry> </qualifier> <pattern>.*\.crl HTTP.*User\-Agent.*</pattern> <context>http-req-headers</context> </pattern-match> </operator> </entry> </or-condition> </entry> <entry name="And Condition 2"> <or-condition> <entry name="Or Condition 1"> <operator> <pattern-match> <pattern>((application/pkix-crl)|(application/x-pkcs7-crl)|(text/plain)|(application/octet-stream)).*</pattern> <context>http-rsp-headers</context> </pattern-match> </operator> </entry> </or-condition> </entry> </and-condition> <scope>session</scope> <order-free>no</order-free> </entry> </signature> <subcategory>infrastructure</subcategory> <category>networking</category> <technology>client-server</technology> <description>matches CRL download</description> <risk>2</risk> <evasive-behavior>no</evasive-behavior> <consume-big-bandwidth>no</consume-big-bandwidth> <used-by-malware>no</used-by-malware> <able-to-transfer-file>no</able-to-transfer-file> <has-known-vulnerability>yes</has-known-vulnerability> <tunnel-other-application>no</tunnel-other-application> <tunnel-applications>no</tunnel-applications> <prone-to-misuse>no</prone-to-misuse> <pervasive-use>no</pervasive-use> <file-type-ident>no</file-type-ident> <virus-ident>no</virus-ident> <data-ident>no</data-ident> <default> <port> <member>tcp/80</member> </port> </default> </entry> </application>
This is the app that I got to work and added a 3rd way that I found within the wireshark traces.
But again, this is my first attempt on getting anything working with a custom PAN app-id and I used the base application provided within this Post. Without that I wouldn't have even known where to begin.
Feel free to try it out and maybe/hopefully you find a flaw or something. I wouldn't be surprised if there is something odd in there.
I must have been doing something wrong, as I'm getting matches off of this now. Thank you for the quick reply. Appears to be working!
Still not sure why the below will create a match. I udnerstand the http.* But the User\-Agent directly after it doesn't make sense. Unless the firewall is taking "any" of these patterns and making a match against what it sees?
A request I see in a browsers appears to look like:
GET /pkiops/crl/MicCodSigPCA2011_2011-07-08.crl HTTP/1.1
there is only a User-Agent listed as a separate request header:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
But it must check any of these fields?
To be honest the User Agent part was already in there.
I just took the app, tried it..... tried to so what wireshark says/shows and searched some documents on how the string should look.
if I recall correctly there is only a difference was pattern matching and changing it to "session" instead of "protocol-data-unit" after that it worked and I added the case for "application/octet-stream" since I found some CRL Pages sending it like that.
I don't know or do much with custom App-ID so maybe someone else can weigh in on it.
I'm not sure on this, but it looks like octet-stream, might be a fallback for an unknown. BTW-Changing to session did the trick. Makes sense as to why "transaction" wouldn't match this no matter what I was adding. It almost looks as though the firewall wasn't reading that HTTP response. Even though the below post seems to say otherwise:
So are you running the app successfully now in your environment?
I have it deployed on a larger scale now and so far if i add a URL filterping profile with alert for all alloed categories I do see only *.crl files in the URL log hitting. But in traffic Log I have a lot more hits (to the same public IPs) then what I have in the URL log.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!