Smarter by Design.Simpler for Business
waf rule-parts
The waf rule-parts command manages the inspection parts of a WAF rule. Every part targets a region of the request (the path, the query string, the headers, the body) and a key in that region, and determines the restrictions to be applied to that key and to its value.
Command Summary
# Tab after the command
admin@TR7LBWAF01> waf rule-parts
add delete list show update
admin@TR7LBWAF01> waf rule-parts list poolId <vservice> hostGroupId <group> ruleId <rule>
admin@TR7LBWAF01> waf rule-parts add poolId <vservice> hostGroupId <group> ruleId <rule> loc query …
admin@TR7LBWAF01> waf rule-parts update poolId <vservice> hostGroupId <group> ruleId <rule> id <id> …
admin@TR7LBWAF01> waf rule-parts delete poolId <vservice> hostGroupId <group> ruleId <rule> <id>
admin@TR7LBWAF01>
Required Fields
In the add command the CLI asks for the required fields in the following order, one by one; it does not show the next one before one is written. The fields are written with the field name and its value together. The fields specific to the region open only after the fourth field, loc.
| Order | Field | Status | Value |
|---|---|---|---|
| 1 | poolId | Required | The vService record the part is bound to |
| 2 | hostGroupId | Required | The host group record the part is bound to |
| 3 | ruleId | Required | The rule the part belongs to; the rules are listed with the path they match |
| 4 | loc | Required | path · query · header · json · xml · form · raw. It cannot be changed after it is created |
In the update command, in the fourth place, instead of loc, id is asked for; the list, show and delete commands ask for the first three fields.
In the show and delete commands the identifier of the part is written without the field name after the first three fields. The parts are listed in the selection list in the region: key form, and the ones without a key as region: (all keys).
The Target Key
| Field | What it does | What is written after it |
|---|---|---|
--arg | Determines to which key in the region the inspection will be applied | The key name. When it is left empty, the inspection is applied to all the keys in the region. It cannot be changed after it is created |
The Field Families According to the Regions
Every region opens its own field families. The table below shows which family is present in which regions; then the fields of every region are written one by one.
| Field family | In which regions |
|---|---|
The total size restriction (Size) | path · raw · query · header |
The depth restriction (Depth) | path · json · xml |
The key restrictions (KeyLength, KeyCount, AllowedArgs) | query · header · json · xml · form |
The required keys (MustArgs) | query · header · form |
The content blocking (BlockAll, BlockInvalid) | json · xml · form |
The allowed MIME types (AllowedMimeTypes) | form · raw |
The size, depth, key length and key count restrictions all consist of the same three fields: the operator (.op), the value (.val) and the end of the range (.val2).
If the operator is not none, the value is required
The restriction in the schema requires, when the operator takes a value other than none, that the .val field be a number, and while the operator is -, additionally that the .val2 field be a number too.
loc path — the request path
| Field | What it does | What is written after it |
|---|---|---|
--pathSize.op | Selects how the total size of the region will be compared | none no restriction · <= · = · >= · - range (the default is -, 1–1024) |
--pathSize.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--pathSize.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--pathDepth.op | Selects how the depth will be compared | none no restriction · <= · = · >= · - range (the default is <= 8) |
--pathDepth.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--pathDepth.val2 | Determines the end of the range | A number; it is used only while the operator is - |
loc query — the query string
| Field | What it does | What is written after it |
|---|---|---|
--querySize.op | Selects how the total size of the region will be compared | none no restriction · <= · = · >= · - range (the default is <= 8192) |
--querySize.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--querySize.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--queryKeyLength.op | Selects how the length of the key name will be compared | none no restriction · <= · = · >= · - range (the default is -, 1–128) |
--queryKeyLength.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--queryKeyLength.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--queryKeyCount.op | Selects how the number of keys will be compared | none no restriction · <= · = · >= · - range (the default is <= 16) |
--queryKeyCount.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--queryKeyCount.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--queryAllowedArgs.N | Determines which keys will be allowed in the region | The key name; every key with its own index. An empty list means no restriction |
--queryMustArgs.N | Determines the keys that are required to be present in the region | The key name; every key with its own index |
loc header — the HTTP headers
| Field | What it does | What is written after it |
|---|---|---|
--headerSize.op | Selects how the total size of the region will be compared | none no restriction · <= · = · >= · - range (the default is <= 4096) |
--headerSize.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--headerSize.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--headerKeyLength.op | Selects how the length of the key name will be compared | none no restriction · <= · = · >= · - range (the default is -, 1–128) |
--headerKeyLength.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--headerKeyLength.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--headerKeyCount.op | Selects how the number of keys will be compared | none no restriction · <= · = · >= · - range (the default is <= 32) |
--headerKeyCount.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--headerKeyCount.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--headerAllowedArgs.N | Determines which keys will be allowed in the region | The key name; every key with its own index. An empty list means no restriction |
--headerMustArgs.N | Determines the keys that are required to be present in the region | The key name; every key with its own index |
loc json — the JSON body
| Field | What it does | What is written after it |
|---|---|---|
--jsonDepth.op | Selects how the depth will be compared | none no restriction · <= · = · >= · - range (the default is <= 8) |
--jsonDepth.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--jsonDepth.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--jsonKeyLength.op | Selects how the length of the key name will be compared | none no restriction · <= · = · >= · - range (the default is -, 1–32) |
--jsonKeyLength.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--jsonKeyLength.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--jsonKeyCount.op | Selects how the number of keys will be compared | none no restriction · <= · = · >= · - range (the default is <= 1024) |
--jsonKeyCount.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--jsonKeyCount.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--jsonAllowedArgs.N | Determines which keys will be allowed in the region | The key name; every key with its own index. An empty list means no restriction |
--jsonBlockAll | Turns on all the content in the region being blocked | true (the default) · false |
--jsonBlockInvalid | Turns on the invalid content in the region being blocked | true (the default) · false |
loc xml — the XML body
| Field | What it does | What is written after it |
|---|---|---|
--xmlDepth.op | Selects how the depth will be compared | none no restriction · <= · = · >= · - range (the default is <= 32) |
--xmlDepth.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--xmlDepth.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--xmlKeyLength.op | Selects how the length of the key name will be compared | none no restriction · <= · = · >= · - range (the default is -, 1–64) |
--xmlKeyLength.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--xmlKeyLength.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--xmlKeyCount.op | Selects how the number of keys will be compared | none no restriction · <= · = · >= · - range (the default is <= 1024) |
--xmlKeyCount.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--xmlKeyCount.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--xmlAllowedArgs.N | Determines which keys will be allowed in the region | The key name; every key with its own index. An empty list means no restriction |
--xmlBlockAll | Turns on all the content in the region being blocked | true (the default) · false |
--xmlBlockInvalid | Turns on the invalid content in the region being blocked | true (the default) · false |
loc form — the form body
| Field | What it does | What is written after it |
|---|---|---|
--formKeyLength.op | Selects how the length of the key name will be compared | none no restriction · <= · = · >= · - range (the default is -, 1–64) |
--formKeyLength.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--formKeyLength.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--formKeyCount.op | Selects how the number of keys will be compared | none no restriction · <= · = · >= · - range (the default is <= 32) |
--formKeyCount.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--formKeyCount.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--formAllowedArgs.N | Determines which keys will be allowed in the region | The key name; every key with its own index. An empty list means no restriction |
--formMustArgs.N | Determines the keys that are required to be present in the region | The key name; every key with its own index |
--formBlockAll | Turns on all the content in the region being blocked | true (the default) · false |
--formBlockInvalid | Turns on the invalid content in the region being blocked | true (the default) · false |
--formAllowedMimeTypes.N | Determines which MIME types will be allowed in the region | The MIME type; every type with its own index. An empty list means no restriction |
--formFileOwasp | Turns on the OWASP inspection being applied to the uploaded files | true (the default) · false |
loc raw — the raw body
| Field | What it does | What is written after it |
|---|---|---|
--rawSize.op | Selects how the total size of the region will be compared | none no restriction · <= · = · >= · - range (the default is -, 1–16384) |
--rawSize.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--rawSize.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--rawAllowedMimeTypes.N | Determines which MIME types will be allowed in the region | The MIME type; every type with its own index. An empty list means no restriction |
--rawBlockUnparsed | Turns on the raw body that cannot be parsed being blocked | true (the default) · false |
--rawBlockUnexpectedError | Turns on the blocking on an unexpected parsing error | true · false (the default is false) |
The Fields Common to Every Region
The fields below are present in every part, independently of the loc value.
| Field | What it does | What is written after it |
|---|---|---|
--valueLength.op | Selects how the length of the value of the key will be compared | none no restriction · <= · = · >= · - range (the default is -, 0–1024) |
--valueLength.val | Determines the value to be compared | A number; while the operator is -, the beginning of the range |
--valueLength.val2 | Determines the end of the range | A number; it is used only while the operator is - |
--argOwasp | Turns on the OWASP inspections being applied to this part | true (the default) · false |
--argOwaspExclusions.N | Determines the OWASP rule keys that will not be applied in this part | The rule key; every key with its own index, the same key cannot be written twice |
--argLog | Turns on the value being written into the log at the blocking | true (the default) · false |
--argRegex.input | Determines the regular expression the value has to match | A regular expression in the Hyperscan dialect. An empty input means no restriction |
--argMultiple | Determines at most how many times the same key can be repeated | An integer between 0 and 1000000 |
Examples
# let the value of a single key in the query string be a number and at most 8 characters
admin@TR7LBWAF01> waf rule-parts add poolId <vservice> hostGroupId <group> ruleId <rule> \
loc query --arg id \
--valueLength.op "<=" --valueLength.val 8 --argRegex.input "^[0-9]+$"
# across the region: at most 10 keys in the query, only three names allowed
admin@TR7LBWAF01> waf rule-parts add poolId <vservice> hostGroupId <group> ruleId <rule> \
loc query --queryKeyCount.op "<=" --queryKeyCount.val 10 \
--queryAllowedArgs.0 id --queryAllowedArgs.1 page --queryAllowedArgs.2 sort
# depth and invalid content inspection in the JSON body
admin@TR7LBWAF01> waf rule-parts add poolId <vservice> hostGroupId <group> ruleId <rule> \
loc json --jsonDepth.op "<=" --jsonDepth.val 6 --jsonBlockInvalid true
# the allowed MIME types in the form body
admin@TR7LBWAF01> waf rule-parts update poolId <vservice> hostGroupId <group> ruleId <rule> id <id> \
--formAllowedMimeTypes.0 image/png --formAllowedMimeTypes.1 image/jpeg
admin@TR7LBWAF01>
Things to Know
- A part belongs to a rule. In every command it is stated with
poolId,hostGroupIdandruleIdon the parts of which rule it is worked; the rules are in thewaf fw-rulescommand. - The region and the key cannot be changed afterwards. The
locand--argfields are marked as fixed in the schema; for another region or key a new part is created. - If the key is left empty, it becomes an inspection across the region. When
--argis not given, the inspection is applied to all the keys in the region. - The region determines the fields. The
locvalue determines which fields will be listed; the CLI asks for it after thepoolId,hostGroupIdandruleIdfields and the fields specific to the region open only after that. - The required fields do not take
--.poolId,hostGroupId,ruleIdandlocare written with the field name and its value side by side; the optional fields are in the--field valueform. The detail is on the API Commands page. - The comparison operators require quotes. The values such as
<=,>=and-are written inside double quotes so that they are not counted as a redirection by the shell. - An empty list means no restriction. When the allowed key and allowed MIME type lists are left empty, no restriction is applied in that region.
- The records carry only the fields of their own region. According to the explanation in the schema, a part does not store the fields outside the region in which it was created.
