Forum Discussion

icherif_189553's avatar
icherif_189553
Icon for Nimbostratus rankNimbostratus
Jun 09, 2015

Class for regular expressions | Filter requests from attacks

Hello all, I am new in F5 irule and i want to filter requests and drop those that contain attack signatures. Signatures (in form of regex) are stored in a class and all requests (GET and POST) should be filtered with each regex.

I thought it will be something like this (For the GET requests) :

if { [class match [string tolower HTTP::uri] contains class_attack_blocked] } {
        log local0.alert "attack blocked"
       }

The content of the class is :

/((\%27)|(\'))union/ix

Could you please help me. Thanks in advance.