Forum Discussion
smiley_dba
Nimbostratus
Aug 13, 2019Simplier way to review URL/URI and block
Question. creating an iRule that will look through a a URL+URI packet and drop the connection. Think Im doing this right, but trying to think if an OR statement or a elseif would be the appropriate syntax.
when HTTP_REQUEST {
log local0. "Requested connection [HTTP::host][HTTP::path], converted [string tolower [HTTP::host][HTTP::path]]"
if {[string match -nocase "autodiscover.something.com" [HTTP::host]] && [string match -nocase "/owa" [string trimright [HTTP::path]]]}
or {[string match -nocase "owa.something.com" [HTTP::host]] && [string match -nocase "/owa" [string trimright [HTTP::path]]]}
or {[string match -nocase "ews.something.com" [HTTP::host]] && [string match -nocase "/owa" [string trimright [HTTP::path]]]}
or {[string match -nocase "mail.something.com" [HTTP::host]] && [string match -nocase "/owa" [string trimright [HTTP::path]]]}
log local0. "Rejected Connection [HTTP::host][HTTP::path], converted [string tolower [HTTP::host][HTTP::path]]"
drop}
}
}
would this be the correct format with multiple entries? Thank you in advance.
No RepliesBe the first to reply
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects