Forum Discussion

barry_8239's avatar
barry_8239
Icon for Nimbostratus rankNimbostratus
Jun 24, 2013

allow rule vs deny

I would like to add a new irule which permits all previous versions of Apple IOS from 6.145 and will deny anything release thereafter. This is our current rule

 

when HTTP_REQUEST {

 

switch -glob [string tolower [HTTP::header User-Agent]] {

 

"*1002.14[0-4]*" {

 

if { [HTTP::uri] contains "Cmd=MeetingResponse" } {

 

reject

 

log local0. "Denied iOS 6.1 Device SNAT src=[IP::client_addr] src_port=[TCP::client_port], dst=[IP::local_addr] dst_port=[TCP::local_port], virtual=[virtual name]"

 

}

 

}

 

}

 

}

 

Thank in advance.

 

application delivery
dev
devops
iRules

2 Replies

Sort By
  • Kevin_Davies_40's avatar
    Kevin_Davies_40
    Icon for Nacreous rankNacreous
    Sep 13, 2013

    If you are talking version numbers your probably better off converting and comparing numerically.

    set num=*get field from user agent*
foreach {major minor sub} [split $num "."] break;

if { $major < 7 } {
  if { $minor < 1002 } {
     if { $sub < 145 } {
         reject
         log local0. "reject reason"
     }
  }
}

    If however the version number is numerically valid.. 

    if {$version < 1006.145} {
   reject
}