File Blocking feature not working with owncloud-uploading application hosted on NGINX web server

[grenzi]

Hello everybody,

  the thread subject is pretty self explanatory. I'm playing with the file-blocking feature and doing some testing. What I've found in my lab environment, using both PAN-OS 10.0.1 and PAN-OS 9.0.9 and both VM-Series an PA-820 appliance, is that file blocking is not always working with application owncloud-uploading.

I have a file-blocking profile configured to block pdf, exe and msi files in both directions (upload and download) and this is what I just found.

**Scenario 1**

Web server: Apache 2.4

Application: Nextcloud 19.0.4

Server architecture: x86-64

PHP: php-fpm

SSL forward proxy: enabled

Scenario 2

WebServer: NGINX 1.19

Application: Nextcloud 19.0.4

Server architecture: ARM

PHP: php-fpm

SSL forward proxy: enabled

In Scenario 1, if I try to upload or download any of the blocked file types, the firewall correctly denies the session as expected and logs the event into the data filtering logs.

In Scenario 2, if I try to download any of the blocked file types, the firewalls denies the session as expected, but if I try to upload the file the firewall permits the session and the upload is successful.

Any idea on how to investigate deeper into this issue? I will update this thread as soon I have time to try other web application on a NGINX web server.

Thanks

[kiwi]

Hi @grenzi ,

Looking at the session details, can you see if the sessions are actually decrypted successfully ? Just thinking out loud here ... do you allow the session if decryption fails ?

Are you seeing the same behaviour in both PAN-OS 10.0 and 9.0 ?

Cheersm

-Kiwi.

[grenzi]

---

@kiwi wrote:

Hi @grenzi ,

Looking at the session details, can you see if the sessions are actually decrypted successfully ? Just thinking out loud here ... do you allow the session if decryption fails ?

Are you seeing the same behaviour in both PAN-OS 10.0 and 9.0 ?

Cheersm

-Kiwi.

---

Hi Kiwi,

 I just figured it out that this behavior could be related to HTTP2. After disabling HTTP2 on the NGINX server, files are correctly blocked in upload as expected. I also found that decryption doesn't work on 9.0 and 9.1 with HTTP2, while in 10.0 it does. I think I have to deepen on how HTTP2 works and why the firewall is unable to detect file uploads while it correctly detects dowloads.