Forum Discussion
Mustafa_Hashmi_
Nimbostratus
May 18, 2016iRule to block http content
Hello all,
I am looking for a simple iRule to inspect HTTP content that is sent back via POST from a particular user and drop if the HTTP content contains
id=sa_sabre&event=sa_exchangeSrvr...
Yann_Desmarest
Cirrus
May 23, 2016Hi,
There is some encoding errors in the above irule, try this one instead, it's the same with some fixed encoding chars :
when HTTP_REQUEST {
if { [HTTP::method] eq "POST" } {
Trigger the collection for up to 1MB of data
if { [HTTP::header Content-Length] ne "" and [HTTP::header value Content-Length] >= 1048576 } {
set content_length [HTTP::header value Content-Length]
} else {
set content_length 1048576
}
Check if $content-length is not set to 0
if { $content_length > 0 } {
HTTP::collect $content_length
}
}
}
when HTTP_REQUEST_DATA {
Do stuff with the payload
set payload "?[HTTP::payload]"
if {([URI::query $payload id] equals "sa_sabre") && (([URI::query $payload event] equals "sa_exchangeSrvr_state") || ([URI::query $payload event] equals "sa_sip_state"))} {
drop
}
}
Mustafa_Hashmi_
Nimbostratus
May 24, 2016Thank you for the rule. Question, when applying irule to our resources, we get the following error:
01070394:3: HTTP_REQUEST event in rule (/Common/Block_Polycom) requires an associated HTTP or FASTHTTP profile on the virtual server (/Common/vs-TMS-HTTPS).
The Virtual server config is:
tmsh create ltm virtual vs-TMS-HTTPS {description "TMS Redundancy Virtual Server" destination 10.0.200.40:443 ip-protocol tcp mask 255.255.255.255 pool pl-TMS-HTTPS profiles add {fastL4} source 0.0.0.0/0 source-address-translation {type automap} translate-address enabled translate-port enabled vlans add {internal} vlans-enabled}
How can we get this iRule applied to our virtual server?
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects