NimbostratusHello all,
I am looking for a simple iRule to inspect HTTP content that is sent back via POST from a particular user and drop if the HTTP content contains
id=sa_sabre&event=sa_exchangeSrvr_state
or
id=sa_sabre&event=sa_sip_state.
Thank you
Cumulonimbustry this irule:
when HTTP_REQUEST {
if {([URI::query [HTTP::uri] id] equals "sa_sabre") && (([URI::query [HTTP::uri] event] equals "sa_exchangeSrvr_state") || ([URI::query [HTTP::uri] event] equals "sa_sip_state"))} {
drop
}
}
This irule do the same for POST method:
when HTTP_REQUEST {
if { [HTTP::method] eq "POST" } {
Trigger the collection for up to 1MB of data
if { [HTTP::header Content-Length] ne "" and [HTTP::header value Content-Length] <= 1048576 } {
set content_length [HTTP::header value Content-Length]
} else {
set content_length 1048576
}
Check if $content-length is not set to 0
if { $content_length > 0 } {
HTTP::collect $content_length
}
}
}
when HTTP_REQUEST_DATA {
Do stuff with the payload
set payload "?[HTTP::payload]"
if {([URI::query $payload id] equals "sa_sabre") && (([URI::query $payload event] equals "sa_exchangeSrvr_state") || ([URI::query $payload event] equals "sa_sip_state"))} {
drop
}
}
NacreousHi,
There is some encoding errors in the above irule, try this one instead, it's the same with some fixed encoding chars :
when HTTP_REQUEST {
if { [HTTP::method] eq "POST" } {
Trigger the collection for up to 1MB of data
if { [HTTP::header Content-Length] ne "" and [HTTP::header value Content-Length] >= 1048576 } {
set content_length [HTTP::header value Content-Length]
} else {
set content_length 1048576
}
Check if $content-length is not set to 0
if { $content_length > 0 } {
HTTP::collect $content_length
}
}
}
when HTTP_REQUEST_DATA {
Do stuff with the payload
set payload "?[HTTP::payload]"
if {([URI::query $payload id] equals "sa_sabre") && (([URI::query $payload event] equals "sa_exchangeSrvr_state") || ([URI::query $payload event] equals "sa_sip_state"))} {
drop
}
}
NimbostratusNimbostratusNimbostratus
CirrusHi,
There is some encoding errors in the above irule, try this one instead, it's the same with some fixed encoding chars :
when HTTP_REQUEST {
if { [HTTP::method] eq "POST" } {
Trigger the collection for up to 1MB of data
if { [HTTP::header Content-Length] ne "" and [HTTP::header value Content-Length] >= 1048576 } {
set content_length [HTTP::header value Content-Length]
} else {
set content_length 1048576
}
Check if $content-length is not set to 0
if { $content_length > 0 } {
HTTP::collect $content_length
}
}
}
when HTTP_REQUEST_DATA {
Do stuff with the payload
set payload "?[HTTP::payload]"
if {([URI::query $payload id] equals "sa_sabre") && (([URI::query $payload event] equals "sa_exchangeSrvr_state") || ([URI::query $payload event] equals "sa_sip_state"))} {
drop
}
}