Forum Discussion

Mick39_201768's avatar
Mick39_201768
Icon for Nimbostratus rankNimbostratus
Jun 05, 2015

found error "bad option" while blocking specific user agent

Hi team,

I got an error like following. Do you have any idea of this?

TCL error: /Common/ua_block - bad option "--user-agent=mozilla/5.0 (x11; linux x86_64) applewebkit/537.36 (khtml, like gecko) chrome/32.0.1700.77 safari/537.36": must be -exact, -glob, -regexp, or -- while executing "switch -glob [string tolower [HTTP::header "User-Agent"]] { "sqlmap" - "havij" - "nmap" - "nessus" - "..."

I think the case is like the case below... https://devcentral.f5.com/questions/switch-glob-behaviour-when-comparison-string-starts-with-a-hyphen

The iRule is like following

when HTTP_REQUEST {

log local0. "User-Agent:[HTTP::header "User-Agent"]"

switch -glob [string tolower [HTTP::header "User-Agent"]] {

    "*sqlmap*" -

    "*havij*" -

    "*nmap*" -

    "*nessus*" -

    "*absinthe*" -

    "*nikto*" -

    "*w3af*" -

    "*pangolin*" -

    "*bsqlbf*" -

    "*prog.customcrawler*" -

    "*sql power injector*" -

    "*mysqloit*" -

    "*netsparker*" {

        if { !([IP::addr [IP::client_addr] equals 192.168.XXX.XXX]) } {

            discard

            log local0. "[HTTP::header "User-Agent"] discarding."

        }

   }

}

}

Thank you for your help.