Forum Discussion
PG0581
Cirrus
CirrusiRule - Block part of a query
Using this example URL: https://abc.com/some-uri.some-extension?func=do-something How would I go about rejecting any queries containing "do-something"? This is what I have tried, and haven't had a...
Hello PG0581 ,
this code should work, and it's exactly how I would build the iRule too.Any reason why you're using "string tolower"? Remember that in this case, your datagroup should be all lowercase characters in order to match.
In my lab, this code is working indeed
I would check profiles on your VS .. you need HTTP profile to parse [HTTP::query] info, and if this HTTPS traffic you also need a clientSSL profile in order to see unencrypted data.
PG0581Cirrus
CirrusI also tried modifying the iRule to use "contains" rather than "eq", but no luck there either:
when HTTP_REQUEST {
if { [class match [string tolower [HTTP::query]] contains data-group-1] }{
log local0. "Denied query: [IP::client_addr] - [HTTP::query]"
reject
}
}
CA_ValliMVP
Hello PG0581 ,
this code should work, and it's exactly how I would build the iRule too.Any reason why you're using "string tolower"? Remember that in this case, your datagroup should be all lowercase characters in order to match.
In my lab, this code is working indeed
I would check profiles on your VS .. you need HTTP profile to parse [HTTP::query] info, and if this HTTPS traffic you also need a clientSSL profile in order to see unencrypted data.
- PG0581
Hi CA_Valli ,
Thanks for testing this. I have typically always used "string tolower", but what I did not realize or had not noticed is the string in the data-group needs to be lowercase as well. Makes total sense! The string in my data-group is not all in lowercase, so I will fix that.
- CA_Valli
Happy to help!
I typically use that syntax if I need to normalize some data, but with URI's /login and /LOGIN would be two different pages and you might have unexpected matches..