Forum Discussion

Mustafa_Hashmi_'s avatar
Mustafa_Hashmi_
Icon for Nimbostratus rankNimbostratus
May 18, 2016

iRule to block http content

Hello all,   I am looking for a simple iRule to inspect HTTP content that is sent back via POST from a particular user and drop if the HTTP content contains   id=sa_sabre&event=sa_exchangeSrvr...
application delivery
iRules
LTM
security
Stanislas_Piro2's avatar
Stanislas_Piro2
Icon for Cumulonimbus rankCumulonimbus
May 18, 2016

try this irule:

when HTTP_REQUEST {
    if {([URI::query [HTTP::uri] id] equals "sa_sabre") && (([URI::query [HTTP::uri] event] equals "sa_exchangeSrvr_state") || ([URI::query [HTTP::uri] event] equals "sa_sip_state"))}  {
        drop
    }
}