Forum Discussion

cdougall_14195's avatar
Jul 12, 2016
Solved

Datagroup audit through VIP

Long and short is that we have an external address datagroup that we interrogate from a VIP for auditing.

Datagroup:

        host x.x.x.x := "blah",
        network y.y.y.0/20 := "blah blah,",
        host z.z.z.z := "blah blah blah",

Rule:

        when HTTP_REQUEST {
            switch [string tolower [HTTP::uri]] {
                "/auditurl" {
                    HTTP::respond 200 content "[string map { " " "\n" } [class names penaltybox-dg]]" Cache-Control "no-cache,no-store" Content-Type "text/plain"
                }
            

This does a good job of dumping out all of the records in the datagroup, but is not an easy thing to filter OUT the host entries. It's a pretty easy to apply a filter to "class name" to include something, but have had a hard time figuring out a way to EXCLUDE something.

        x.x.x.x/32
        y.y.y.0/20
        z.z.z.z/32

Is there a way to filter out all of the host entries, so no more "/32"s in the listing? Any help would be appreciated. Thanks all.

Cameron

  • try something like

    [string map { " " "\n" } [lsearch -all -inline -not [class name penaltybox-dg] */32]]
    

5 Replies

  • i was thinking a

    class match
    might help but i don't see how exactly.

    your doing it in one nice line now, but i would split it up in a loop through the datagroup and only add lines to a variable which don't match /32. then use that variable in the

    HTTP::respond

    if you want to stick with one line another string map might work, but that will take some testing or another contributor who can do it by hard.

  • Ian_Smith_39007's avatar
    Ian_Smith_39007
    Historic F5 Account

    try something like

    [string map { " " "\n" } [lsearch -all -inline -not [class name penaltybox-dg] */32]]
    
    • cdougall_14195's avatar
      cdougall_14195
      Icon for Cirrus rankCirrus

      Thanks Ian, Works great! Only change I made was to add the "-glob"

       

      [string map { " " "\n" } [lsearch -all -inline -glob -not [class names penaltybox-dg] */32]]

       

  • try something like

    [string map { " " "\n" } [lsearch -all -inline -not [class name penaltybox-dg] */32]]
    
    • cdougall_14195's avatar
      cdougall_14195
      Icon for Cirrus rankCirrus

      Thanks Ian, Works great! Only change I made was to add the "-glob"

       

      [string map { " " "\n" } [lsearch -all -inline -glob -not [class names penaltybox-dg] */32]]