PG0581
Dec 12, 2022Cirrus
iRule - Block part of a query
Using this example URL: https://abc.com/some-uri.some-extension?func=do-something
How would I go about rejecting any queries containing "do-something"?
This is what I have tried, and haven't had any luck:
iRule:
when HTTP_REQUEST {
if { [class match [string tolower [HTTP::query]] eq data-group-1] }{
log local0. "Denied query: [IP::client_addr] - [HTTP::query]"
reject
}
}
Data-group:
ltm data-group internal data-group-1 {
records {
do-something { }
}
type string
}
Hello PG0581 ,
this code should work, and it's exactly how I would build the iRule too.Any reason why you're using "string tolower"? Remember that in this case, your datagroup should be all lowercase characters in order to match.
In my lab, this code is working indeed
I would check profiles on your VS .. you need HTTP profile to parse [HTTP::query] info, and if this HTTPS traffic you also need a clientSSL profile in order to see unencrypted data.