For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Patti_G_72768's avatar
Patti_G_72768
Icon for Nimbostratus rankNimbostratus
Oct 21, 2013

iRule for missing or blank headers (user-agent and accept)

Hi all, I'm working on another iRule creation. I need to create a rule that will detect if the request headers for user-agent and/or accept is blank/missing. I also need to be able to exclude uri extensions with rss and smil. Below is the iRule I tried to create based on the requirements. Can I get some help with reviewing the rule and letting me know where I've gone wrong please?

when HTTP_REQUEST {

 if {not ([HTTP::uri] ends_with "rss") and not ([HTTP::uri] ends_with "smil")}
          {
            log local0. "URI extension is not rss or smil."
          }
        elseif { [HTTP::header "User-Agent"] eq "false" }
             {
                 log local0. "User-Agent header is missing."
              }
         elseif { [HTTP::header "Accept"] eq "false" }
              {
                  log local0. "Accept header is missing."
              }
         elseif { [HTTP::header "User-Agent"] contains "^$" }
              {
                  log local0. "User-Agent header is blank."
              }
         elseif { [HTTP::header "Accept"] contains "^$" }
              {
                  log local0. "Accept header is blank."
              }
       }
application delivery
devops
iRules

3 Replies

  • Richard__Harlan's avatar
    Richard__Harlan
    Historic F5 Account
    Oct 21, 2013

    If you want to check if a header exists you can use the following if {[HTTP::header exists User-Agent ]}{

     

    You are checking is the value of User-Agent is False not that it does not exist

     

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Oct 21, 2013

    It's slightly less specific but this should work (note the HTTP::header command will return null if the header doesn't exist or if the header's value is null);

    if { [HTTP::uri] ends_with "rss" or [HTTP::uri] ends_with "smil" } {
 log local0. "URI extension is rss or smil." 
 Optionally drop the traffic
 reject 
 Stop executing the irule
 return }

elseif { [HTTP::header "User-Agent"] eq "" } {
 log local0. "User-Agent header is missing or blank." }

elseif { [HTTP::header "Accept"] eq "" } {
 log local0. "Accept header is missing or blank." }