icherif_189553
Jun 09, 2015Nimbostratus
Class for regular expressions | Filter requests from attacks
Hello all, I am new in F5 irule and i want to filter requests and drop those that contain attack signatures. Signatures (in form of regex) are stored in a class and all requests (GET and POST) should be filtered with each regex.
I thought it will be something like this (For the GET requests) :
if { [class match [string tolower HTTP::uri] contains class_attack_blocked] } {
log local0.alert "attack blocked"
}
The content of the class is :
/((\%27)|(\'))union/ix
Could you please help me. Thanks in advance.