Forum Discussion

J_Saunders_4728's avatar
J_Saunders_4728
Icon for Nimbostratus rankNimbostratus
Jan 30, 2013

Reject based on string in HTTP header

All,

 

 

I want the F5 to reject (or drop) packets that have specific string/text in the HTTP header. I found this:

 

 

when HTTP_REQUEST {

 

if { [HTTP::header exists Morfeus Scanner] } {

 

reject

 

}

 

}

 

 

When I try to add the above iRule I get an error that there are too many arguments in line 2. I removed the second word (Scanner) and it accepted the iRule. BUT, I would prefer to have both words included. Is there a way to do that? Do I use quotes?

 

 

Thanks

 

 

application delivery
dev
devops
iRules

3 Replies

Sort By
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Jan 30, 2013
    Try this: 

    
when HTTP_REQUEST {
foreach header {Morfeus Scanner} {
if { [HTTP::header exists $header] } {
log local0. "Caught $header header"
reject
}
}
}

    The [HTTP::header exists ] command just works on the name of the header, so if you want to capture a header with "Morfeus" or "Scanner" in the value you'll need to modify the iRule.

  • Arie's avatar
    Arie
    Icon for Altostratus rankAltostratus
    Feb 01, 2013
    If it's likely that you will want to block on additional values in the future you may want to consider using a class (Data Group). Just keep in mind that the class and/or values won't be available when you save the class.