irule issue

guys is this irule correct? if i need to block windows/linux access to specific sni on server that has 4 applicaions. so should i use when http_request event after SERVERSSL_CLIENTHELLO_SEND ???

 

when CLIENTSSL_HANDSHAKE { if { [SSL::extensions exists -type 0] } then { set tls_sni_extension [SSL::extensions -type 0] } else { set tls_sni_extension "" } } when SERVERSSL_CLIENTHELLO_SEND { if { $tls_sni_extension ne "" } then { SSL::extensions insert $tls_sni_extension } }

 

when HTTP_REQUEST { if { $tls_sni_extension equals "domain_for_mobile_application" and ([HTTP::header "User-Agent"] contains "Windows" or [HTTP::header "User-Agent"] contains "Linux" or [HTTP::header "User-Agent"] contains "Macintosh") } { drop } }

 

or should i use that

when HTTP_REQUEST { if { ([string tolower [HTTP::uri]] starts_with "domain_for_mobile_application") and ([HTTP::header "User-Agent"] contains "Windows" or [HTTP::header "User-Agent"] contains "Linux" or [HTTP::header "User-Agent"] contains "Macintosh") } { drop } }