Forum Discussion

Born_7758's avatar
Born_7758
Icon for Nimbostratus rankNimbostratus
Jun 14, 2011

Filtering a list of URLs

Hello Everyone,

 

 

To start off, I'd like to mention that I am pretty new at this F5 business (been reading on it for about 2wks).

 

 

 

I am trying to find the best way to filter a list of URLs. Below is the current iRule that we are using, but as you can imagine as the need for additional URLs to be added to the iRule arises, it will be harder to keep track of them. So as a different solution, I would like to be able to insert a new URL into a list instead of having to create an "elseif" statement everytime.

 

 

 

Any help will be greatly appreciated :)

 

 

 

when HTTP_REQUEST {

 

 

 

where member is the parameter name

 

set member_param_1 "/mailSchedulingServices/mailSchedulingService.svc"

 

set member_param_2 "/cardPayMatrixSvc/cardPayMatrixSvc.svc"

 

set response_data "Unauthorized request"

 

 

 

if {[string match $member_param_1 [HTTP::path]]}{

 

Do nothing

 

}

 

elseif {[string match $member_param_2 [HTTP::path]]} {

 

Do nothing

 

} else {

 

log local0. "Compare response with $member_param"

 

HTTP::respond 200 content $response_data

 

}

 

}

 

 

 

 

 

 

 

 

application delivery
dev
devops
iRules

24 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jun 14, 2011
    Hi,

    Welcome to the forums. If you want to create a whitelist of allowed URIs, you could add them to a string datagroup (in the GUI under Local Traffic >> iRules >> Datagroup tab >> Create. You could then use the class command to look up the current path against the datagroup. If the requested path isn't in the datagroup, you could send a 200 response with content.

    Here is the datagroup as it would appear in the bigip.conf: 

    class whitelist_paths_class {
   {
      "/cardPayMatrixSvc/cardPayMatrixSvc.svc"
      "/mailSchedulingServices/mailSchedulingService.svc"
   }
}

    And here is an example iRule to do the lookup: 

    when RULE_INIT {

   set static::block_html {Access denied!}
}
when HTTP_REQUEST {

   if { not [class match [HTTP::path] equals whitelist_paths_class]}{

      HTTP::respond 200 content $static::block_html
   }
}

    Aaron
  • Born_7758's avatar
    Born_7758
    Icon for Nimbostratus rankNimbostratus
    Jun 14, 2011
    Thank you Aaron!

     

     

    Is there a way to do it without using datagroups?

     

     

     

    The reason I ask is because I was given this assignment as a "good starting point" to understand iRules. The person that assigned this task to me asked me to see if there is a way to do it using the "array" syntax.

     

     

     

  • Born_7758's avatar
    Born_7758
    Icon for Nimbostratus rankNimbostratus
    Jun 14, 2011
    When I tried your suggestion I get an error saying:

     

     

    line 5: [undefined procedure: class] [class match [HTTP::path]
  • Born_7758's avatar
    Born_7758
    Icon for Nimbostratus rankNimbostratus
    Jun 14, 2011
    When I tried your suggestion I get an error saying:

     

     

    line 5: [undefined procedure: class] [class match [HTTP::path]
  • Born_7758's avatar
    Born_7758
    Icon for Nimbostratus rankNimbostratus
    Jun 14, 2011
    When I tried your suggestion I get an error saying:

     

     

    line 5: [undefined procedure: class] [class match [HTTP::path]
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jun 14, 2011
    If the class command doesn't exist, you're running v9. You can use matchclass instead: 

    
when HTTP_REQUEST {

   if { not [matchclass [HTTP::path] equals whitelist_paths_class]}{

      HTTP::respond 200 content {Access denied!}
   }
}

    You could do this in an array, but it would be inefficient compared with a datagroup.

    Aaron
  • Born_7758's avatar
    Born_7758
    Icon for Nimbostratus rankNimbostratus
    Jun 14, 2011
    Ok. I really appreciate all the help.

     

     

    One last thing..could you please explain what is happening in the line that says "if { not [matchclass [HTTP::path] equals whitelist_paths_class]}{"
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jun 14, 2011
    matchclass looks up to see if the HTTP::path value exactly matches any entry in the datagroup named "whitelist_paths_class". Then not negates that. So if the requested path isn't in the datagroup, a 200 response is sent back to the client with the HTML content.

     

     

    You can get more info on the matchclass wiki page:

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/matchclass

     

     

    Aaron
  • Born_7758's avatar
    Born_7758
    Icon for Nimbostratus rankNimbostratus
    Jun 14, 2011
    I edited your suggestion and rewrote it like this so that I don't use Run_init ...when i use this it looks like i am no longer to connect to that URL through the browser

     

     

    when HTTP_REQUEST {

     

     

    set response_data "Unauthorized request"

     

     

    if { not [matchclass [HTTP::path] equals Dev_URL_List]}{

     

    }

     

    HTTP::respond 200 content $response_data

     

    }

     

    }