File Blocking feature not working with owncloud-uploading application hosted on NGINX web server

Reply
Highlighted
L2 Linker

File Blocking feature not working with owncloud-uploading application hosted on NGINX web server

Hello everybody,

 

  the thread subject is pretty self explanatory. I'm playing with the file-blocking feature and doing some testing. What I've found in my lab environment, using both PAN-OS 10.0.1 and PAN-OS 9.0.9 and both VM-Series an PA-820 appliance, is that file blocking is not always working with application owncloud-uploading.

 

I have a file-blocking profile configured to block pdf, exe and msi files in both directions (upload and download) and this is what I just found.

 

**Scenario 1**

Web server: Apache 2.4

Application: Nextcloud 19.0.4

Server architecture: x86-64

PHP: php-fpm

SSL forward proxy: enabled

 

Scenario 2

WebServer: NGINX 1.19

Application: Nextcloud 19.0.4

Server architecture: ARM

PHP: php-fpm

SSL forward proxy: enabled

 

In Scenario 1, if I try to upload or download any of the blocked file types, the firewall correctly denies the session as expected and logs the event into the data filtering logs.

 

In Scenario 2, if I try to download any of the blocked file types, the firewalls denies the session as expected, but if I try to upload the file the firewall permits the session and the upload is successful.

 

Any idea on how to investigate deeper into this issue? I will update this thread as soon I have time to try other web application on a NGINX web server.

 

Thanks

--
Linus Torvalds does not push the toilette flush button, he just says "make clean".
Highlighted
Community Team Member

Hi @grenzi ,

 

Looking at the session details, can you see if the sessions are actually decrypted successfully ? Just thinking out loud here ... do you allow the session if decryption fails ?

Are you seeing the same behaviour in both PAN-OS 10.0 and 9.0 ?

 

Cheersm

-Kiwi.

 
Highlighted
L2 Linker


@kiwi wrote:

Hi @grenzi ,

 

Looking at the session details, can you see if the sessions are actually decrypted successfully ? Just thinking out loud here ... do you allow the session if decryption fails ?

Are you seeing the same behaviour in both PAN-OS 10.0 and 9.0 ?

 

Cheersm

-Kiwi.

 

Hi Kiwi,

 

 I just figured it out that this behavior could be related to HTTP2. After disabling HTTP2 on the NGINX server, files are correctly blocked in upload as expected. I also found that decryption doesn't work on 9.0 and 9.1 with HTTP2, while in 10.0 it does. I think I have to deepen on how HTTP2 works and why the firewall is unable to detect file uploads while it correctly detects dowloads.

--
Linus Torvalds does not push the toilette flush button, he just says "make clean".
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!