For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

MW1's avatar
MW1
Icon for Cirrus rankCirrus
May 02, 2018

Match content in HTTP request and response - and block if value does not match

All, Been asked to implement a temporary fix for a web site until the server side fix can be written. The need is to query a soap POST request coming in to a web site on a specific URI, decode the ...
application delivery
BIG-IP
iRules
security
MW1's avatar
MW1
Icon for Cirrus rankCirrus
May 02, 2018

Managed to resolve myself - Just to advise found I needed to switch

if match allow request - else block response 
when HTTP_RESPONSE_DATA {
        if { [string match  $orgstring [HTTP::payload]] } {
        log local0. "Temp fix-irule matched OrgString - allowing response)      
        return
        }{
        else discard
        log local0. "Temp fix-irule failed to match OrgString - dropping response"
    }
    }
`


To be :


`  if response data contains match allow request - else block response     
when HTTP_RESPONSE_DATA {
            if { [HTTP::payload] contains $orgstring  } {
        HTTP::release
                log local0. "Temp fix-irule match HomeOrg $homeorg to EnterpriseOrg $orgstring allowing request"
        }
        else {
                HTTP::respond 500 content BLOCKED
                log local0. "Temp fix-irule HomeOrg $homeorg to EnterpriseOrg $orgstring does not match -- dropping request"
    }
    }