Could naxsi support block empty user-agent?

[akong77]

Hello,
I know nginx can use hook to add block empty user-agent.I want know naxsi could support it?

[Fright]

it should
may be something like:

Code Select Expand

MainRule negative id:1700 "rx:^(?!\s*$).+" "msg:Empty_UA" "mz:$HEADERS_VAR_X:User-Agent"
not tested

[akong77]

OK,I will test it.Thanks a lot.

[akong77]

I test it.It's can't block it.

[Fright]

test it. works

Code Select Expand

curl -H "User-Agent;" http://myCA_CRL_URL

Code Select Expand

*32507 NAXSI_EXLOG: ip=some_ip&server=my_serever&uri=%2Fcrl_file&id=1700&zone=HEADERS&var_name=user-agent&content=, client: some_ip, server: my_server, request: "GET /my.crl HTTP/1.1", host: "my_server

[akong77]

If you try

curl -A '' -H 'User-Agent;' http://web -I

[akong77]

Sorry,I make mistake.It's can block it.Thanks a lot.
I want know about naxsi.It's can choose drop connection this option.What the different block request and drop connection?I test it.I feel no different.

[Fright]

https://github.com/nbs-system/naxsi/wiki/rules-bnf

specifiy an action such a BLOCK (blocks the request in non-learning mode) or DROP (blocks the request even in learning mode)

DROP is not "DROP connection". its block even in learning mode

[akong77]

So,Whatever choose block request or drop connection it's always show opnsense request denied webpage.
Right?

[Fright]

yep

[akong77]

it should
may be something like:

Code Select Expand

MainRule negative id:1700 "rx:^(?!\s*$).+" "msg:Empty_UA" "mz:$HEADERS_VAR_X:User-Agent"
not tested

Hello,I test it.
If I use browers like firefox to see http://ab.aspa.idv.tw.it's also show Request Denied.
You can check http://ab.aspa.idv.tw

[Fright]

and whats in the "HTTP Error logs" for this requests?

[akong77]

*19 NAXSI_FMT: ip=219.84.34.52&server=ab.aspa.idv.tw&uri=/&learning=0&vers=0.56&total_processed=12&total_blocked=10&block=1&cscore0=$policy20906cd5e25e413f9fe6e733c38d3586&score0=16&zone0=HEADERS&id0=15001&var_name0=user-agent&zone1=HEADERS|NAME&id1=15001&var_name1=user-agent, client: 219.84.34.52, server: ab.aspa.idv.tw, request: "GET / HTTP/1.1", host: "ab.aspa.idv.tw"

*19 NAXSI_FMT: ip=219.84.34.52&server=ab.aspa.idv.tw&uri=/favicon.ico&learning=0&vers=0.56&total_processed=13&total_blocked=11&block=1&cscore0=$policy20906cd5e25e413f9fe6e733c38d3586&score0=16&zone0=HEADERS&id0=15001&var_name0=user-agent&zone1=HEADERS|NAME&id1=15001&var_name1=user-agent, client: 219.84.34.52, server: ab.aspa.idv.tw, request: "GET /favicon.ico HTTP/1.1", host: "ab.aspa.idv.tw", referrer: "http://ab.aspa.idv.tw/"

[Fright]

zone1=HEADERS|NAME

and how exactly rule 15001 looks like?
and can you enable "Extensive Naxsi Log" in server properties and post NAXSI_EXLOG log for blocked request?

[akong77]

MainRule id:15001 "rx:^(?!\s*$).+" "msg:Empty UA" "mz:$HEADERS_VAR_X:User-Agent" "s:$policy20906cd5e25e413f9fe6e733c38d3586:8";