Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 301 / 861

300 Controlling traffic at the security gateway
Blocking inappropriate content with content filtering
For example, assume that you want to prevent users from browsing Web sites with adult material. A
common combination of letters in an adult Web site URL might be XXX. To restrict URLs with this
three-letter combination, you could write the following expression:
XXX
This expression tells the security gateway to look for the combination of three uppercase Xs in a URL,
and if found, deny the request. However, the expression does not match URLs that use lowercase
letters or have more or less than three xs.
It might be difficult to match the patterns of all of the sites that you want to exclude with one
expression, so you might want to add additional expressions. For example,
xxx
When you use the XXX and xxx expressions together, URLs that contain three uppercase Xs or three
lowercase xs are blocked, but nothing else. You can use character set variables to block sites that might
use mixed cases. To block sites that contain three uppercase Xs, three lowercase xs, or any combination
of three consecutive uppercase and lowercase Xs, use the following expression:
[Xx][Xx][Xx]
As shown in Table 8-1 , the [and] characters denote a range of characters that should be matched.
Because you are looking specifically for three consecutive letters, you need to set up three sets of
brackets.
Use caution when you use the * character as a global wildcard character. For example, if you intend to
use the expression [Xx]* to block sites that contain XXX or xxx, you will block all sites. This is because
the * character means zero or more occurrences. Therefore, you block all URLs regardless of whether
they contain XXX and xxx.
URL pattern matching can also be used to block buffer overflow attacks. A buffer overflow attack
occurs when text is added to the last portion of the URL in an attempt to overrun the Web server. For
example: ?%2%c0x5a. This type of attack might cause the Web server to behave in a way it normally
would not. Once you know what the signature looks like, you can add the appropriate URL to list to
block the request.
Prerequisites
None.
\B Matches a non-word boundary.
\n Matches a newline character.
\w Matches any alphanumeric character, including the underscore (same as [A-Za-z0-9_]).
\W Matches any non-word character (same as [^A-Za-z0-9_]).
\< Anchors the pattern to the beginning of a word.
\> Anchors the pattern to the end of a word.
‘ Marks the beginning of a buffer.
\’ Terminates a buffer. If a single quote is used again, everything in between the two single quotes is
interpreted literally.
Table 8-1
Supported regular expression symbols (Continued)
Symbol Description