September 10, 2013 at 09:50Error in the work of L7 in Mikrotik
Solving the problem , revealed the strange behavior of L7 in Mikrotik. When explicitly specified in a regular expression, the case is ignored, even if the characters in the regular expression are specified in bytes.
We pose the problem (the task was specially invented to demonstrate the error).
Block the following URL: http://chelaxe.ru/Summary/
As can be seen in the URL there is a letter in upper case: the S .
To do this, we will use Layer7 in MikroTik , which can gut packets. It collects the first 10 packets or 2kb from the connection and looks for the necessary regular expression data in them.
Everything is configured like this:
Now you need to compose the correct regular expression ( POSIX ). At first, I just tried to do this:
but it didn’t work out, then I took Wireshark and looked at the packages:
As you can see, the GET line in the package is separate from the Host line and the GET line goes earlier:
Redo the regular expression:
Check:
To check and create regular used regex101.com thanks 0dmin for the article Parse Regular Expressions .
Add everything to MikroTik and go to http://chelaxe.ru/Summary/
As a result: DOES NOT WORK We
fix the regular expression on:
As a result: WORKS, but blocks both http://chelaxe.ru/Summary/ and http://chelaxe.ru/summary/ (specially created two pages that are case-sensitive for the letter S)
I tried to do it differently:
This is a line in bytes corresponds, lines / Summary /
As a result: DOES NOT WORK
Change byte \ x53 to \ x73 (S to s):
As a result: WORKS, but blocks both http://chelaxe.ru/Summary/ and http: // chelaxe .ru / summary /
It turns out that the package leaves me in with a string in upper case and comes to the server in the same form (the site parses in upper case or lower case), the regular expression is correct, but it does not return anything when searching for a string in upper case, and when searching for a string lower case returns both options (both upper and lower).
Conclusion: It is impossible to use L7 in MikroTik to determine case-sensitive information in a package.
UPD: I used version v5.26 (the last in branch 5), and in branch 6 this bug was fixed:
Checked in version v6.3 everything works as it should. So this feature has a place to be, only in the 5th RouterOS branch.
Reflections: I looked at how providers block the sites from the registry: when changing the register in the GET path, the page is still blocked.
If a site with such a page blocked will create a page with the same URL only in upper case and require it to be unblocked because it does not contain anything forbidden, then the URL entered in the registry will also be unlocked.
We pose the problem (the task was specially invented to demonstrate the error).
Block the following URL: http://chelaxe.ru/Summary/
As can be seen in the URL there is a letter in upper case: the S .
To do this, we will use Layer7 in MikroTik , which can gut packets. It collects the first 10 packets or 2kb from the connection and looks for the necessary regular expression data in them.
Everything is configured like this:
/ip firewall layer7-protocol add name=lock regexp=^.*(\/Summary\/).*(chelaxe\.ru).*$/ip firewall filter add action=drop chain=forward disabled=no dst-port=80 layer7-protocol=lock protocol=tcp src-address=192.168.0.0/24Via winbox
Now you need to compose the correct regular expression ( POSIX ). At first, I just tried to do this:
^.*(chelaxe\.ru\/Summary\/).*$but it didn’t work out, then I took Wireshark and looked at the packages:
As you can see, the GET line in the package is separate from the Host line and the GET line goes earlier:
GET /Summary/ HTTP/1.1Host: chelaxe.ruRedo the regular expression:
^.*(\/Summary\/).*(chelaxe\.ru).*$Check:
To check and create regular used regex101.com thanks 0dmin for the article Parse Regular Expressions .
Add everything to MikroTik and go to http://chelaxe.ru/Summary/
As a result: DOES NOT WORK We
fix the regular expression on:
^.*(\/summary\/).*(chelaxe\.ru).*$As a result: WORKS, but blocks both http://chelaxe.ru/Summary/ and http://chelaxe.ru/summary/ (specially created two pages that are case-sensitive for the letter S)
I tried to do it differently:
^.*(\x2f\x53\x75\x6d\x6d\x61\x72\x79\x2f).*$This is a line in bytes corresponds, lines / Summary /
As a result: DOES NOT WORK
Change byte \ x53 to \ x73 (S to s):
^.*(\x2f\x73\x75\x6d\x6d\x61\x72\x79\x2f).*$As a result: WORKS, but blocks both http://chelaxe.ru/Summary/ and http: // chelaxe .ru / summary /
It turns out that the package leaves me in with a string in upper case and comes to the server in the same form (the site parses in upper case or lower case), the regular expression is correct, but it does not return anything when searching for a string in upper case, and when searching for a string lower case returns both options (both upper and lower).
Conclusion: It is impossible to use L7 in MikroTik to determine case-sensitive information in a package.
UPD: I used version v5.26 (the last in branch 5), and in branch 6 this bug was fixed:
What's new in 6.0rc12 (2013-Mar-26 17:18):
*) fixed layer7 matcher - it is case insensitive now;
Checked in version v6.3 everything works as it should. So this feature has a place to be, only in the 5th RouterOS branch.
Reflections: I looked at how providers block the sites from the registry: when changing the register in the GET path, the page is still blocked.
at TTK:
If a site with such a page blocked will create a page with the same URL only in upper case and require it to be unblocked because it does not contain anything forbidden, then the URL entered in the registry will also be unlocked.