Blocking iOS 6.1 Devices on Exchange 2010

Barry,

 

This rule is not to restrict access to Mail but rather to specifically block access to them using the MeetingResponse Cmd within Exchange. So essentially they can't Accept or Decline meeting but they can still do all other Exchange sync functionality.

Hi all,

 

 

As IOS 6.1.2 is out, anybody who know the new version number?

 

 

Jan

 

Updated to allow iOS 6.1.2 (which is 1002.146). This rule will match versions 1002.1 through 1002.145:

if {[HTTP::header "User-Agent"] matches_regex {^Apple.*1002.([1-9]|[1-9][0-9]|1[0-3][0-9]|14[0-5])$} } { if { [HTTP::uri] contains "Cmd=MeetingResponse" } { reject } } 

Hi Mike

 

 

appreciate the code share, we will be applying this shortly.

 

 

 

-Daniel

Here's what we have right now, seems to be working for the moment:

 

priority 100

 

when HTTP_REQUEST {

 

 

if {[HTTP::header "User-Agent"] matches_regex {^Apple.*1002.146} } {

 

if { [HTTP::uri] contains "Cmd=MeetingResponse" } {

 

pool

 

}

 

}

 

elseif {[HTTP::header "User-Agent"] matches_regex {^Apple.*1002.*} } {

 

if { [HTTP::uri] contains "Cmd=MeetingResponse" } {

 

reject

 

}

 

}

 

}

 

 

 

I like Goat's iRule better, using it now, works great.

 

 

Thanks Goat!

Anybody who can review this irule and see any problem, before I try this live?

 

 

priority 100

 

when HTTP_REQUEST {

 

if {[HTTP::header "User-Agent"] matches_regex {^Apple.*1002.([Z1-9]|[Z1-9][Z0-9]|1[Z0-3][Z0-9]|14[Z0-5])$} } { if { [HTTP::uri] contains "Cmd=MeetingResponse" } { reject } }

 

log local0. "Denied iOS 6.1 Device SNAT src=[IP::client_addr] src_port=[TCP::client_port], dst=[IP::local_addr] dst_port=[TCP::local_port], virtual=[virtual name]"

 

event disable all

 

 

}

Jan, from a functionality perspective;

 

 

1) The log and event disable all commands are outside the second if statement, it will run these every time even if there is no match, they need to be moved to after the reject and before the } }

 

Regarding performance;

 

 

1) Would it not be better to check for "Cmd=MeetingResponse" first to save running the 'expensive' regex every time the rule is fired

 

2) Do you really need to log that level of information?

 

Hi Steve,

 

 

I can skip the event disable all.

 

No I would like to check the Apple version first and then MeetingResponse, but you right regex maybye not the best tool for match.

 

The log is good to have for troubleshooting, but the level could be less.

 

 

This is what I use right now, but I need to allow 1002.146 and block between 1002.140 > 1002.145

 

Any sugestion to solve it?

 

 

priority 100

 

when HTTP_REQUEST {

 

if {[string match -nocase "apple*1002*" [HTTP::header "User-Agent"]] and [HTTP::uri] contains "Cmd=MeetingResponse" } {

 

log local0. "Denied iOS 6.1.x src=[IP::client_addr] src_port=[TCP::client_port], dst=[IP::local_addr] dst_port=[TCP::local_port], virtual=[virtual name]"

 

reject

 

event disable all

 

}

 

}

 

 

Jan

This should do it;

when HTTP_REQUEST {
 switch -glob [string tolower [HTTP::header User-Agent]] {
  "*1002.140*" -
  "*1002.141*" -
  "*1002.142*" -
  "*1002.143*" -
  "*1002.144*" -
  "*1002.145*" {
   if { [HTTP::uri] contains "Cmd=MeetingResponse" } {
    reject
    log local0. "Denied iOS 6.1 Device SNAT src=[IP::client_addr] src_port=[TCP::client_port], dst=[IP::local_addr] dst_port=[TCP::local_port], virtual=[virtual name]"
   }
  }
 }
}