wlepkin_98758
Apr 12, 2012Nimbostratus
string range arguments
Hi, I'm trying to capture the first x-forwarded-for header value in an http request. There's probably a more efficient way to do this, but this is what I came up with:
when HTTP_REQUEST {
if { [HTTP::header exists X-Forwarded-For] } then
{
set header_values [HTTP::header values X-Forwarded-For]
log local0. "X-Forwarded-For exists, value = $header_values"
set no_of_headers [HTTP::header count X-Forwarded-For]
log local0. "Number of X-Forwarded-For headers is $no_of_headers"
if { $no_of_headers > 0 } then
{
set blank_index [ string wordstart $header_values " " ]
log local0. "Blank index = $blank_index"
set client_addr [ string range $header_values 0 [ expr {$blank_index - 1} ] ]
unset blank_index
}
else
{
set client_addr $header_values
}
log local0. "Client addr = $client_addr"
unset header_values no_of_headers
}
else
{
set client_addr [IP::client_addr]
log local0. "No X-Forwarded-For exists, client addr = $client_addr"
}
unset client_addr
}
So I check to see if there is more than one header, and if so get the index of the first blank space in the string of header values, then do a string range from the beginning of the string of values to the index of the first space minus 1.
But I get the following error: "Rule [display-x-forwarded-for] error: line 10: [invalid index: should be integer or "end"] [" "]." And for all I know I may be making other mistakes that I haven't gotten to yet.
What am I doing wrong?
Thanks much,
Wayne