Forum Discussion

Basil_Parsley_1's avatar
Basil_Parsley_1
Icon for Nimbostratus rankNimbostratus
Feb 28, 2017

class match with OR - irule not capturing traffic as expected

Guys can someone help with the below – I have a funny feeling I could be heading for a “plant face on desk” moment …   Requirement to selectively block a HSL logging irule from logging to my SIEM...
application delivery
iRules
JG's avatar
JG
Icon for Cumulonimbus rankCumulonimbus
Feb 28, 2017
when HTTP_REQUEST {
    if { not ([class match [IP::client_addr] equals ip_external_scan_addresses]) } {
        log local0. "[IP::client_addr] is not in acl ip_external_scan_addresses"
    } elseif { [HTTP::header values "X-Forwarded-For"] ne ""} {
        set found 0
        foreach xff_item [split [string map [list " " ""] [HTTP::header "X-Forwarded-For"]] ","] {
            if { [class match $xff_item equals ip_external_scan_addresses] } {
                set found 1
                break
            }
        }
        if { $found == 0 } {
            log local0. "[IP::client_addr] is not on acl ip_external_scan_addresses."
        }
    }
}