iRule to block http content

try this irule:

when HTTP_REQUEST {
    if {([URI::query [HTTP::uri] id] equals "sa_sabre") && (([URI::query [HTTP::uri] event] equals "sa_exchangeSrvr_state") || ([URI::query [HTTP::uri] event] equals "sa_sip_state"))}  {
        drop
    }
}

This irule do the same for POST method:

when HTTP_REQUEST {
   if { [HTTP::method] eq "POST" } {
       Trigger the collection for up to 1MB of data
      if { [HTTP::header Content-Length] ne "" and [HTTP::header value Content-Length] <= 1048576 } {
         set content_length [HTTP::header value Content-Length]
      } else {
         set content_length 1048576
      }
       Check if $content-length is not set to 0
      if { $content_length > 0 } {
         HTTP::collect $content_length
      }
   }
}
when HTTP_REQUEST_DATA {
    Do stuff with the payload
   set payload "?[HTTP::payload]"
   if {([URI::query $payload id] equals "sa_sabre") && (([URI::query $payload event] equals "sa_exchangeSrvr_state") || ([URI::query $payload event] equals "sa_sip_state"))}  {
        drop
    }
} 

Hi,

There is some encoding errors in the above irule, try this one instead, it's the same with some fixed encoding chars :

when HTTP_REQUEST {
   if { [HTTP::method] eq "POST" } {
       Trigger the collection for up to 1MB of data
      if { [HTTP::header Content-Length] ne "" and [HTTP::header value Content-Length] >= 1048576 } {
         set content_length [HTTP::header value Content-Length]
      } else {
         set content_length 1048576
      }
       Check if $content-length is not set to 0
      if { $content_length > 0 } {
         HTTP::collect $content_length
      }
   }
}
when HTTP_REQUEST_DATA {
    Do stuff with the payload
   set payload "?[HTTP::payload]"
   if {([URI::query $payload id] equals "sa_sabre") && (([URI::query $payload event] equals "sa_exchangeSrvr_state") || ([URI::query $payload event] equals "sa_sip_state"))}  {
        drop
    }
} 

Hi,

There is some encoding errors in the above irule, try this one instead, it's the same with some fixed encoding chars :

when HTTP_REQUEST {
   if { [HTTP::method] eq "POST" } {
       Trigger the collection for up to 1MB of data
      if { [HTTP::header Content-Length] ne "" and [HTTP::header value Content-Length] >= 1048576 } {
         set content_length [HTTP::header value Content-Length]
      } else {
         set content_length 1048576
      }
       Check if $content-length is not set to 0
      if { $content_length > 0 } {
         HTTP::collect $content_length
      }
   }
}
when HTTP_REQUEST_DATA {
    Do stuff with the payload
   set payload "?[HTTP::payload]"
   if {([URI::query $payload id] equals "sa_sabre") && (([URI::query $payload event] equals "sa_exchangeSrvr_state") || ([URI::query $payload event] equals "sa_sip_state"))}  {
        drop
    }
}