Configuring a Rewrite Policy

After you create any needed rewrite action, you must create at least one rewrite policy to select the requests that you want the Citrix ADC appliance to rewrite.

A rewrite policy consists of a rule, which itself consists of one or more expressions. And an associated action that is done if a request or response matches the rule. Policy rules for evaluating HTTP requests and responses can be based on almost any part of a request or response.

You can’t use TCP rewrite actions to rewrite data other than the TCP payload. You can base the policy rules for TCP rewrite policies on the information in the transport layer. And the layers below the transport layer.

If a configured rule matches a request or response, the corresponding policy is triggered and the action associated is carried out.

Note:You can use either the command line interface or the configuration utility to create and configure rewrite policies. Users who are not thoroughly familiar with the command line interface and the Citrix ADC Policy expression language will usually find using the configuration utility much easier.

To add a new rewrite policy by using the command line interface

在命令提示符下,键入以下命令to add a new rewrite policy and verify the configuration:

• []

Example 1. Rewriting HTTP Content:

> add rewrite policy policyNew "HTTP.RES.IS_VALID" insertact NOREWRITE Done > show rewrite policy policyNew Name: policyNew Rule: HTTP.RES.IS_VALID RewriteAction: insertact UndefAction: NOREWRITE Hits: 0 Undef Hits: 0 Done 

Example 2. Rewriting a TCP Payload (TCP Rewrite):

>添加重写策略client_tcp_payload_policy CLIENT.IP.SRC.EQ(172.168.12.232) client_tcp_payload_replace_all Done > show rewrite policy client_tcp_payload_policy Name: client_tcp_payload_policy Rule: CLIENT.IP.SRC.EQ(172.168.12.232) RewriteAction: client_tcp_payload_replace_all UndefAction: Use Global LogAction: Use Global Hits: 0 Undef Hits: 0 Done > 

To modify an existing rewrite policy by using the command line interface

在命令提示符下,键入以下命令to modify an existing rewrite policy and verify the configuration:

• -rule []

Example:

> set rewrite policy policyNew -rule "HTTP.RES.IS_VALID" -action insertaction Done > show rewrite policy policyNew Name: policyNew Rule: HTTP.RES.IS_VALID RewriteAction: insertaction UndefAction: NOREWRITE Hits: 0 Undef Hits: 0 Done 

To remove a rewrite policy by using the command line interface

At the command prompt, type the following command to remove a rewrite policy:

rm rewrite policy

Example:

> rm rewrite policy policyNew Done 

To configure a rewrite policy by using the configuration utility

1. Navigate toAppExpert > Rewrite > Policies.
2. In the details pane, do one of the following:
   • To create a policy, click Add.
   • To modify an existing policy, select the policy, and then click Open.
3. ClickCreateorOK. A message appears in the status bar, stating that the Policy has been configured successfully.
4. Repeat steps 2 through 4 to create or modify as many rewrite actions as you want.
5. ClickClose. To delete a rewrite policy, select the rewrite policy you want to delete, then clickRemoveand, when prompted, confirm your choice by clickingOK.

Create rewrite policy for content security headers, XSS protection, HSTS, X-Content-Type-Options, and Content-Security-Policy

At the command prompt, type the following rewrite action commands to add Security header to webpages served through NetScaler using rewrites.

add rewrite action insert_STS_header insert_http_header Strict-Transport-Security "\"max-age=157680000\"" add rewrite action rw_act_insert_XSS_header insert_http_header X-Xss-Protection "\"1; mode=block\"" add rewrite action rw_act_insert_Xcontent_header insert_http_header X-Content-Type-Options "\"nosniff\"" add rewrite action rw_act_insert_Content_security_policy insert_http_header Content-Security-Policy "\"default-src \'self\' ; script-src \'self\' \'unsafe-inline\' \'unsafe-eval\' ; style-src \'self\' \'unsafe-inline\' \'unsafe-eval\'; img-src \'self\' data:\"" 

At the command prompt, type the following rewrite policy commands to add Security header to webpages served through NetScaler using rewrites.

add rewrite policy enforce_STS true insert_STS_header add rewrite policy rw_pol_insert_XSS_header "HTTP.RES.HEADER("X-Xss-Protection").EXISTS.NOT" rw_act_insert_XSS_header add rewrite policy rw_pol_insert_XContent TRUE rw_act_insert_Xcontent_header add rewrite policy rw_pol_insert_Content_security_policy TRUE rw_act_insert_Content_security_policy 

在命令提示符下,键入以下命令to bind policies to virtual server on Response using Goto Expression NEXT.

bind vpn vserver access -policy enforce_STS -priority 100 -gotoPriorityExpression NEXT -type RESPONSE bind vpn vserver "VSERVERNAME" -policy rw_pol_insert_XSS_header -priority 110 -gotoPriorityExpression NEXT -type RESPONSE bind vpn vserver access -policy rw_pol_insert_XContent -priority 120 -gotoPriorityExpression NEXT -type RESPONSE bind vpn vserver access -policy rw_pol_insert_Content_security_policy -priority 130 -gotoPriorityExpression NEXT -type RESPONSE 

Configure rewrite policy for content security headers, XSS protection, HSTS, X-Content-Type-Options, and Content-Security-Policy using configuration utility

1. Navigate toAppExpert>Rewrite>Actions
2. ClickAddto create rewrite actions for each one of the headers.
3. Navigate toAppExpert>Rewrite>Policies
4. ClickAddto create rewrite policies and link them to actions.
5. Bind policies to virtual server on Response using the Goto ExpressionNEXT.

Note:In SSLVPN, we need to use the below Content-Security Action:

add rewrite action Rewrite_Insert_Content-Security-Policy insert_http_header Content-Security-Policy "\"default-src \'self\' ; script-src \'self\' \'unsafe-inline\' \'unsafe-eval\' ; style-src \'self\' \'unsafe-inline\' \'unsafe-eval\'; img-src \'self\' http://localhost:* data:;\" 

The localhost exception is required because the browser passes the cookie/GW information to the plug-in using localhost HTTP call. Since the CSP had only “self”, only calls to the virtual server would be allowed.