search

F5Networks / f5-appsvcs-extension

F5 BIG-IP Application Services 3 Extension
Apache License 2.0
163 stars 52 forks source link

Unable to configure all DoS network vectors #803

Open normelton opened 4 months ago

normelton commented 4 months ago

Environment

Summary

When enabling denial-of-service network vectors, it seems impossible to enable three:

Steps To Reproduce

Steps to reproduce the behavior:

  1. Submit the following declaration:

    {
"schemaVersion": "3.14.0",
"class": "ADC",
"Tenant": {
    "class": "Tenant",
    "Application": {
        "template": "generic",
        "dos-policy": {
          "class": "DOS_Profile",
          "network": {
          "vectors": [
            {
              "type": "flood",
              "state": "detect-only",
              "thresholdMode": "manual",
              "rateThreshold": 40000,
              "rateIncreaseThreshold": 500,
              "rateLimit": 1000000
            }                
          ]
        }
      }
    }
}
}

  2. Observe the following error response:

    {
"code": 422,
"errors": [
"/dos-policy/A1/dos-policy/network/vectors/0/type: should be equal to one of the allowed values ["ext-hdr-too-large","hop-cnt-low","host-unreachable","icmpv4-flood","icmpv6-flood","icmp-frag","ip-frag-flood","ip-low-ttl","ip-opt-frames","ipv6-ext-hdr-frames","ipv6-frag-flood","non-tcp-connection","opt-present-with-illegal-len","sweep","tcp-half-open","tcp-opt-overruns-tcp-hdr","tcp-psh-flood","tcp-rst-flood","tcp-syn-flood","tcp-synack-flood","tcp-syn-oversize","tcp-bad-urg","tcp-window-size","tidcmp","too-many-ext-hdrs","udp-flood","unk-tcp-opt-type"]"
],
"declarationFullId": "",
"message": "declaration is invalid"
}

Expected Behavior

If AS3 can enable 26 of the network vectors, it would be great if it could cover the remaining three.

mdditt2000 commented 4 months ago

Jira AUTOTOOL-4241 for prioritization