Forum Discussion
nrelihan_68143
Jul 12, 2011Nimbostratus
Blacklist iRule Chrome browser Problem
Hey all,
I have an issue when I do a scan on the http payload using chrome I can't find the following value "reqID=doLogin".
When running in ie or Firefox I have no such issue.
...
nrelihan_68143
Jul 12, 2011Nimbostratus
Heres the code: for some reason I couldnt include it in the post!
when HTTP_REQUEST
{
If { [HTTP::payload] contains "reqID=doLogin" && [HTTP::method] equals "POST" }
reqID is the unique identifier for the login page
{
if {[HTTP::header exists X-Forwarded-For]}
See note below
{ HTTP::header replace X-Forwarded-For "[HTTP::header X-Forwarded-For], [IP::client_addr]" }
else { HTTP::header insert X-Forwarded-For [IP::client_addr] }
If { [matchclass [IP::remote_addr] equals $::ipBlackListTable] }
If the IP exists within the ipBlackListTable, block user from advancing once details are logged
{
HTTP::header insert X-Forwarded-For [IP::remote_addr]
set usrid [findstr [HTTP::payload] "username=" 9 "&"]
Find the username with in the http payload – located between the 9 character and &
log local1. "[clock format [clock seconds]] - BLACKLIST: Username = $usrid from [IP::remote_addr] - requested [HTTP::host][HTTP::uri] - asdf."
log the result to local1 (/var/log/em) in the stated format
What is written to this log is the basis to what will be emailed to the business.
HTTP::redirect "http://[HTTP::host][HTTP::uri]"
Once logged send user to and error page – thus black listing the user
}
elseif { [matchclass [IP::remote_addr] equals $::ipWatchListTable] }
If the IP exists within the ipWatchListTable, allow user to advance once details are logged
{
HTTP::header insert X-Forwarded-For [IP::remote_addr]
set usrid [findstr [HTTP::payload] "username=" 9 "&"]
Find the username with in the http payload – located between the 9 character and &
log local1. "[clock format [clock seconds]] - WATCHLIST: Username = $usrid from [IP::remote_addr] - requested [HTTP::host][HTTP::uri] - asdf."
log the result to local1 (/var/log/em) in the stated format
What is written to this log is the basis to what will be emailed to the business.
}
}
}
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects