Forum Discussion

smiley_dba's avatar
smiley_dba
Icon for Nimbostratus rankNimbostratus
Aug 13, 2019

Simplier way to review URL/URI and block

Question. creating an iRule that will look through a a URL+URI packet and drop the connection. Think Im doing this right, but trying to think if an OR statement or a elseif would be the appropriate syntax.

when HTTP_REQUEST {
  log local0. "Requested connection [HTTP::host][HTTP::path], converted [string tolower [HTTP::host][HTTP::path]]"
  if {[string match -nocase "autodiscover.something.com" [HTTP::host]] && [string match -nocase "/owa" [string trimright [HTTP::path]]]} 
	or {[string match -nocase "owa.something.com" [HTTP::host]] && [string match -nocase "/owa" [string trimright [HTTP::path]]]}
	or {[string match -nocase "ews.something.com" [HTTP::host]] && [string match -nocase "/owa" [string trimright [HTTP::path]]]}
	or {[string match -nocase "mail.something.com" [HTTP::host]] && [string match -nocase "/owa" [string trimright [HTTP::path]]]}
    log local0. "Rejected Connection [HTTP::host][HTTP::path], converted [string tolower [HTTP::host][HTTP::path]]"
    drop}
  }
}

would this be the correct format with multiple entries? Thank you in advance.

No RepliesBe the first to reply