Forum Discussion
Mustafa_Hashmi_
Nimbostratus
May 18, 2016iRule to block http content
Hello all,
I am looking for a simple iRule to inspect HTTP content that is sent back via POST from a particular user and drop if the HTTP content contains
id=sa_sabre&event=sa_exchangeSrvr...
Yann_Desmarest_
Nacreous
May 23, 2016Hi,
There is some encoding errors in the above irule, try this one instead, it's the same with some fixed encoding chars :
when HTTP_REQUEST {
if { [HTTP::method] eq "POST" } {
Trigger the collection for up to 1MB of data
if { [HTTP::header Content-Length] ne "" and [HTTP::header value Content-Length] >= 1048576 } {
set content_length [HTTP::header value Content-Length]
} else {
set content_length 1048576
}
Check if $content-length is not set to 0
if { $content_length > 0 } {
HTTP::collect $content_length
}
}
}
when HTTP_REQUEST_DATA {
Do stuff with the payload
set payload "?[HTTP::payload]"
if {([URI::query $payload id] equals "sa_sabre") && (([URI::query $payload event] equals "sa_exchangeSrvr_state") || ([URI::query $payload event] equals "sa_sip_state"))} {
drop
}
}
Mustafa_Hashmi_
Nimbostratus
May 23, 2016OK removed && and replaced with "and" and the iRule saved.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects