Forum Discussion
PG0581
Cirrus
CirrusiRule - Block part of a query
Using this example URL: https://abc.com/some-uri.some-extension?func=do-something How would I go about rejecting any queries containing "do-something"? This is what I have tried, and haven't had a...
Hello PG0581 ,
this code should work, and it's exactly how I would build the iRule too.Any reason why you're using "string tolower"? Remember that in this case, your datagroup should be all lowercase characters in order to match.
In my lab, this code is working indeed
I would check profiles on your VS .. you need HTTP profile to parse [HTTP::query] info, and if this HTTPS traffic you also need a clientSSL profile in order to see unencrypted data.
Kai_Wilke
MVP
MVPHi PG0581,
you may check the modified iRule below...
when HTTP_REQUEST {
if { [class match -- [URI::query [HTTP::uri -normalized] "func"] equals data-group-1] } then {
log local0. "Denied query: [IP::client_addr] - param func=[URI::query [HTTP::uri -normalized] "func"]"
HTTP::respond 403 content "Access Denied" "Content-Type" "text/html"
}
}
It applies HTTP::uri -nomalization to the request URI, then extracts the URI parameter "func" and then checks the value based on your Data-Group. If the func param is listed in the blacklist, it sends a HTTP 403 Access Denied to the client (slightly better than using a TCP reject).
Cheers, Kai
