Question on syntax of iRule

Question

Hello,&nbsp;
I'm struggling with syntax on the following, and was wondering if anyone had suggestions.  I've tried combining Mozilla and Opera using '||', but that seemed to produce the same error (below).&nbsp;
If an IE/Firefox/Chrome client browser attempts to connect to REST Test &amp; no SSO cookie exists, reject.
when HTTP_REQUEST {
if { ( [HTTP::header value "User-Agent"] contains "Mozilla" ) or ( [HTTP::header value "User-Agent"] contains "Opera" ) and ([string tolower [HTTP::uri]] matches_regex {restservicestest}) and { not [HTTP::cookie names] contains ".test" } then {
    reject
    log local0. "Client browser trying to connect to REST Host:[HTTP::host]; URI = [HTTP::uri]  No SSO Cookie Detected, Client IP:[IP::client_addr] has been blocked"
   }
  } &nbsp;
}&nbsp;
ERROR Text s/iRule syntax checking:
Exception caught in LocalLB::urn:iControl:LocalLB/Rule::create()
Exception: Common::OperationFailed
primary_error_code   : 17236305 (0x01070151)
secondary_error_code : 0
error_string         : 01070151:3: Rule [/Common/iRuler_Parse_Test_Rule] error: /Common/iRuler_Parse_Test_Rule:3: error: [parse error: PARSE syntax 366 {syntax error in expression " ( [HTTP::header value "User-Agent"] contains "Mozilla" ) or...": extra tokens at end of expression}][{ ( [HTTP::header value "User-Agent"] contains "Mozilla" ) or ( [HTTP::header value "User-Agent"] contains "Opera" ) and ([string tolower [HTTP::uri]] matches_regex {restservicestest}) and { not [HTTP::cookie names] contains ".test" } then {
    reject
    log local0. "Client browser trying to connect to REST Host:[HTTP::host]; URI = [HTTP::uri]  No SSO Cookie Detected, Client IP:[IP::client_addr] has been blocked"
   }
  }]
/Common/iRuler_Parse_Test_Rule:7: error: [missing a script after "if"][ ]&nbsp;
Thank you,
Eric&nbsp;

kai_wilke · Answer

Hi Eric,
you may try this snippet...
when HTTP_REQUEST { 
    if { (( [HTTP::header value "User-Agent"] contains "Mozilla" ) or 
          ( [HTTP::header value "User-Agent"] contains "Opera" )) and 
          ( [string tolower [HTTP::uri]] matches_regex {restservicestest} ) and 
          not ( [HTTP::cookie names] contains ".test" ) } then { 
        reject 
        log local0. "Client browser trying to connect to REST Host:[HTTP::host]; URI = [HTTP::uri] No SSO Cookie Detected, Client IP:[IP::client_addr] has been blocked" 
    } 
 }

Cheers, Kai

aaron_brailsfor · Answer

I think the problem is you've enclosed the expression operators with brackets () rather than braces {}, this should work:
when HTTP_REQUEST {
    if { 
            {
                [HTTP::header value "User-Agent"] contains "Mozilla"
                || [HTTP::header value "User-Agent"] contains "Opera"
            }
        &amp;&amp; [string tolower [HTTP::uri]] matches_regex {restservicestest}
        &amp;&amp; { not [HTTP::cookie names] contains ".test" }
    } then { 
        reject
        log local0. "Client browser trying to connect to REST Host:[HTTP::host]; URI = [HTTP::uri] No SSO Cookie Detected, Client IP:[IP::client_addr] has been blocked" 
    }
}

aaronjb · Answer

I think the problem is you've enclosed the expression operators with brackets () rather than braces {}, this should work:
when HTTP_REQUEST {
    if { 
            {
                [HTTP::header value "User-Agent"] contains "Mozilla"
                || [HTTP::header value "User-Agent"] contains "Opera"
            }
        &amp;&amp; [string tolower [HTTP::uri]] matches_regex {restservicestest}
        &amp;&amp; { not [HTTP::cookie names] contains ".test" }
    } then { 
        reject
        log local0. "Client browser trying to connect to REST Host:[HTTP::host]; URI = [HTTP::uri] No SSO Cookie Detected, Client IP:[IP::client_addr] has been blocked" 
    }
}

eric_weiss_2486 · Answer

Hello Aaron, many thanks for your suggestion.  This worked better, although the HTTP::cookie names doesn't seem to be matching on contains '.fb'.  In the following example, I'm wondering if there's a way to check for '.fb' inside any cookie?

when HTTP_REQUEST {
    if {
                [HTTP::header value "User-Agent"] contains "Mozilla"
                || [HTTP::header value "User-Agent"] contains "Opera"
        &amp;&amp; { not [HTTP::cookie names] contains ".fb" }
        &amp;&amp; [string tolower [HTTP::uri]] matches_regex {restservicesintstest}
    } then {
        reject
        log local0. "Client browser trying to connect to REST Host:[HTTP::host]; URI=[HTTP::uri]"
        log local0. "No SSO Cookie Detected, Client IP:[IP::client_addr] has been blocked"
    }
}

Feb 23 09:21:52 lb01 info tmm1[15541]: Rule /Common/SecAuthREST-IntS-Test : Client browser trying to connect to REST Host:fb1restservicesintstest.fb; URI=/communication/notifications/isAlive
Feb 23 09:21:52 lb01 info tmm1[15541]: Rule /Common/SecAuthREST-IntS-Test : No SSO Cookie Detected, Client IP:10.0.22.218 has been blocked

eric_weiss_2486 · Answer

Hello Aaron, many thanks for your suggestion.  This worked better, although the HTTP::cookie names doesn't seem to be matching on contains '.fb'.  In the following example, I'm wondering if there's a way to check for '.fb' inside any cookie?

when HTTP_REQUEST {
    if {
                [HTTP::header value "User-Agent"] contains "Mozilla"
                || [HTTP::header value "User-Agent"] contains "Opera"
        &amp;&amp; { not [HTTP::cookie names] contains ".fb" }
        &amp;&amp; [string tolower [HTTP::uri]] matches_regex {restservicesintstest}
    } then {
        reject
        log local0. "Client browser trying to connect to REST Host:[HTTP::host]; URI=[HTTP::uri]"
        log local0. "No SSO Cookie Detected, Client IP:[IP::client_addr] has been blocked"
    }
}

Feb 23 09:21:52 lb01 info tmm1[15541]: Rule /Common/SecAuthREST-IntS-Test : Client browser trying to connect to REST Host:fb1restservicesintstest.fb; URI=/communication/notifications/isAlive
Feb 23 09:21:52 lb01 info tmm1[15541]: Rule /Common/SecAuthREST-IntS-Test : No SSO Cookie Detected, Client IP:10.0.22.218 has been blocked

Forum Discussion

Question on syntax of iRule

7 Replies

Recent Discussions

redirect not working

Reliable resources for identifying IP addresses

Could not connect to SMTP host.

Viprion files on blades.

The best load balance method on this scenario?

Related Content

irule logging question

what's wrong with my syntax in this iRule?

Health monitor question

syntax for simple http monitor

F5 Connection Mirroring question