irule to allow only certain uris

Question

I'm trying to create an simple iRule that will allow only uris that are in the data group "allowed uris". My iRule is:&nbsp;
when HTTP_REQUEST {&nbsp;
    if {[matchclass [HTTP::uri] equals "allowed_uris "]}&nbsp;
{forward}&nbsp;
else&nbsp;
{discard}&nbsp;
}&nbsp;
and the data group is defined as:&nbsp;
class allowed_uris  {&nbsp;
  "/site1/*"&nbsp;
  "/site2/*"&nbsp;
  "/site3/*"&nbsp;
}&nbsp;
 &nbsp;
When the iRule is enabled, it seems to discard all http requests. Is my data group syntax wrong or is there something wrong that I'm not seeing in our iRule?&nbsp;
 &nbsp;

what_lies_bene1 · Answer

This should work, note Data Groups interpret * literally, you can't use wildcards, remove these before trying this; 
 
when HTTP_REQUEST {
 if { [ class match [string tolower [HTTP::uri]] contains allowed_uris ] } {
  Stop processing the iRule for this event here
  return
 else {
  drop }
 }
}

what_lies_bene1 · Answer

Try these, found in a post by Hoolio; 
 http://www.zytrax.com/tech/web/mobile_ids.html 
 http://en.wikipedia.org/wiki/List_of_user_agents_for_mobile_phones&nbsp;

scarnes_82101 · Answer

Thanks,&nbsp;
&nbsp;
When I try the iRule above, I'm getting:&nbsp;
&nbsp;
01070151:3: Rule [allowed_uris] error: line 4: [wrong  args] [return else { drop }]&nbsp;
&nbsp;
Any thoughts?&nbsp;

what_lies_bene1 · Answer

Sorry, a bracket was in the wrong place; 
 
when HTTP_REQUEST {
 if { [ class match [string tolower [HTTP::uri]] contains allowed_uris ] } {
  Stop processing the iRule for this event here
  return }
 else {
  drop }
 }

scarnes_82101 · Answer

Removing the * from the data group and using the updated iRule works like a charm. Thanks for the assist.

Forum Discussion

irule to allow only certain uris

7 Replies

Recent Discussions

ASM instance creation

[ASM] - what is "Browser Challange file" ?

[ASM] - HTML5 Cross-Domain Request Enforcement - CLI command

Reverse Proxy Not Behaving

Stable Firmware for F5

Related Content

iRules Style Guide

Hey ChatGPT, can you write iRules?

POC: Validate JWT with iRule

irule

Avoiding Common iRules Security Pitfalls