Hello Al, I am fighting with blocking the URL using rex exp. Kindly ask for advise . The case is to block access to URL with following strings: */v2/*/manifests/* */v2/*/blobs/* I was trying with following: ^https?://.*v2.*blobs or ^https?://.*v2.*blobs.* or even .*v2.* The first 2 are not working at all The last is working only for something like https://v2.com/ but for https://aaa.com/v2 not Can You please advise?

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Regexp to block URL

Andrzej Banczak over 2 years ago

Hello Al,

I am fighting with blocking the URL using rex exp. Kindly ask for advise.

The case is to block access to URL with following strings:

*/v2/*/manifests/*
*/v2/*/blobs/*

I was trying with following:

^https?://.*v2.*blobs

^https?://.*v2.*blobs.*

or even

.*v2.*

The first 2 are not working at all

The last is working only for something like https://v2.com/ but for https://aaa.com/v2 not

Can You please advise?

This thread was automatically locked due to age.

Parents

0 BAlfson over 2 years ago

Cześć Andrzej and welcome to the UTM Community!

Please copy a line here from the Web Filtering log containing a URL you want to block.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Andrzej Banczak over 2 years ago in reply to BAlfson

Hey BAlfson

This is what I configured:

Following reg expressions:

https://www.*v2.*blobs

and

^https?://.*v2.*blobs

for URL http://docker.com/test/v2/test/blobs/ it is working:

2021:11:29-11:52:02 webproxy-pl httpproxy[17299]: id="0062" severity="info" sys="SecureWeb" sub="http" name="web request blocked, forbidden url detected" action="block" method="GET" srcip="IP" dstip="" user="" group="" ad_domain="" statuscode="403" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="3025" request="0x9838000" url="">docker.com/.../" referer="" error="" authtime="0" dnstime="0" aptptime="0" cattime="108" avscantime="0" fullreqtime="368" device="0" auth="0" ua="Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36" exceptions=""

but for https://www.docker.com/test/v2/test/blobs/ it is not working, and I cannot see any logs

loginuser@webproxy-pl:/var/log > tail -f *.log | grep -F "/test/v2/test/blobs/" show nothing
Cancel
Vote Up 0 Vote Down

Cancel
0 dirkkotte over 2 years ago in reply to Andrzej Banczak

regex looks ok. Possible you have an exception for domain www.docker.com ?

Do you see a hit within firewall-log?

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up 0 Vote Down

Cancel
0 Andrzej Banczak over 2 years ago in reply to dirkkotte

hey dirkkotte

Exact the same behavior for any other URL. The docker was only an example.

I do see some problems with the https URL`s. When URL is http - works, when https - do not work.

maybe I am missing some additional configuration?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Andrzej Banczak over 2 years ago in reply to dirkkotte

hey dirkkotte

Exact the same behavior for any other URL. The docker was only an example.

I do see some problems with the https URL`s. When URL is http - works, when https - do not work.

maybe I am missing some additional configuration?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 dirkkotte over 2 years ago in reply to Andrzej Banczak

i am unsure
... possible with https the SG can't see the full url?

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up 0 Vote Down

Cancel
0 Andrzej Banczak over 2 years ago in reply to dirkkotte

In the same filter profile I do have following regexp on black list:

chomikuj.pl

and

http://chomikuj.pl/

and for this - everything is working

http://chomikuj.pl/ -> blocked

https://chomikuj.pl -> blocked

Maybe I will try to open the support case.
Cancel
Vote Up 0 Vote Down

Cancel