iRule to filter on URIs and strings in the body of the payload

HI PG05851,

the iRule you have posted includes several issues that will disrupt your application.

1.) You put too much checks in one if statement. If for an example the POST request is not in the uri-list, you will always start to HTTP::collect 1MB data. If the post request from the client is less than 1MB, than this would stall the connection.

2.) You did not checked if Content-Length contains valid data. This may flood you logfiles with TCL errors if someone does silly things.

3.) The syntax of the [findstr] command in wrong. Findstr is a command to perform a string cutting operation for a single input. You can not use an "and" operator in between. 

You may check the modified iRule below...

when HTTP_REQUEST {

    # Check for POST request send to known URI and contains payload to analyse
	
	if { ( [HTTP::method] eq "POST" ) 
	 and ( [class match -- [string tolower [HTTP::path]] contains uri-list] )
	 and ( [HTTP::header value "Content-Length"] >= 1 ) } then {
		
		# Perform input validation and check for configured upper limits
		 
		if { not [string is digit [HTTP::header value "Content-Length"] } then {
			
			# Malformed Content-Length header...
			
			HTTP::respond 400 content "BAD REQUEST"			
			
		} elseif { [HTTP::header value "Content-Length"] <= 1048576 } then {
			
			# Less than upper limit...
			
			HTTP::collect [HTTP::header value "Content-Length"]
			
		} else {

			# Bigger than upper limits. Collecting only till upper limit...
			
			HTTP::collect 1048576
			
		}
	} else {
		# No need to collect...
	}
}
when HTTP_REQUEST_DATA {
	
	# Check for "forbidden strings" (use lowercase rules) in the payload...
	
	switch -glob -- [string tolower [HTTP::payload]] {
		"*f o rbi dd en s tring*" {
			# Found a forbidden string...
			log local0.debug "Denied: [IP::client_addr] - [HTTP::path] - *f o rbi dd en s tring*"
			HTTP::respond 403 content "Forbidden" "Content-Type" "text/html"  
		}
		"*for bid den string*"  {
			# Found a forbidden string...
			log local0.debug "Denied: [IP::client_addr] - [HTTP::path] - *for bid den string*"
			HTTP::respond 403 content "Forbidden" "Content-Type" "text/html"  
		}
		"*fo rbi dden str ing*" {
			# Found a forbidden string...
			log local0.debug "Denied: [IP::client_addr] - [HTTP::uri] - *fo rbi dden str ing*"
			HTTP::respond 403 content "Forbidden" "Content-Type" "text/html"  
		}
	}
}

You could also use a Data-Group based approach in the HTTP_REQUEST_DATA even if your like...

when HTTP_REQUEST_DATA {
	
	# Check for "forbidden strings" (use lowercase rules) in the payload...
	
	if { [set match_string [class match -name -- [string tolower [HTTP::payload]] contains black-list ] ne "" } then {
			# Found a forbidden string...
			log local0.debug "Denied: [IP::client_addr] - [HTTP::uri] - $match_string"
			HTTP::respond 403 content "Forbidden" "Content-Type" "text/html"  
	}
}

Depending on how the payload actually looks like and what you are trying to block, your may need other adjustments in HTTP_REQUEST_DATA event.

Cheers, Kai