f5-appsvcs-extension icon indicating copy to clipboard operation
f5-appsvcs-extension copied to clipboard

Unable to configure all DoS network vectors

Open normelton opened this issue 1 year ago • 1 comments

Environment

  • Application Services Version: 3.48.0
  • BIG-IP Version: 17.1.0.2

Summary

When enabling denial-of-service network vectors, it seems impossible to enable three:

  • TCP Flags Uncommon
  • TCP ACK Flood
  • Flood

Steps To Reproduce

Steps to reproduce the behavior:

  1. Submit the following declaration:
{
    "schemaVersion": "3.14.0",
    "class": "ADC",
    "Tenant": {
        "class": "Tenant",
        "Application": {
            "template": "generic",
            "dos-policy": {
              "class": "DOS_Profile",
              "network": {
              "vectors": [
                {
                  "type": "flood",
                  "state": "detect-only",
                  "thresholdMode": "manual",
                  "rateThreshold": 40000,
                  "rateIncreaseThreshold": 500,
                  "rateLimit": 1000000
                }                
              ]
            }
          }
        }
    }
}
  1. Observe the following error response:
{
  "code": 422,
  "errors": [
    "/dos-policy/A1/dos-policy/network/vectors/0/type: should be equal to one of the allowed values ["ext-hdr-too-large","hop-cnt-low","host-unreachable","icmpv4-flood","icmpv6-flood","icmp-frag","ip-frag-flood","ip-low-ttl","ip-opt-frames","ipv6-ext-hdr-frames","ipv6-frag-flood","non-tcp-connection","opt-present-with-illegal-len","sweep","tcp-half-open","tcp-opt-overruns-tcp-hdr","tcp-psh-flood","tcp-rst-flood","tcp-syn-flood","tcp-synack-flood","tcp-syn-oversize","tcp-bad-urg","tcp-window-size","tidcmp","too-many-ext-hdrs","udp-flood","unk-tcp-opt-type"]"
  ],
  "declarationFullId": "",
  "message": "declaration is invalid"
}

Expected Behavior

If AS3 can enable 26 of the network vectors, it would be great if it could cover the remaining three.

normelton avatar Feb 13 '24 21:02 normelton

Jira AUTOTOOL-4241 for prioritization

mdditt2000 avatar Feb 13 '24 22:02 mdditt2000