REST API Query

Oops, bad CIDR. It should have been. It works now.

 

 

class UserDataGroup {

 

{

 

network 10.8.0.0/13

 

network 10.16.0.0/13

 

}

 

}

Which LTM version are you running? For 9.4.4+ you should remove the $:: prefix from the datagroup name references in the iRule. If you're on v10, you could also change matchclass to 'class match' to improve the efficiency of the iRule:

 

 

http://devcentral.f5.com/wiki/default.aspx/iRules/class

 

 

Also, if you're using IIS, you should set the URI to lowercase in the switch statement. You could also check HTTP::path instead of HTTP::uri. This would catch someone using a URI like /login.aspx? or /login.aspx?ignore=this to bypass your logic.

 

 

switch -glob [string tolower [HTTP::path]] {

 

 

Aaron

Thanks. I did note the change to "class match" shortly after my initial post. I appreciate the you mentioning HTTP::path. I'll implement it as well as the lowercase.

Here is what I ended up with.

 

 

when CLIENT_ACCEPTED {

 

set DEBUG "0"

 

if { $DEBUG } {log local0. "Client IP address is: [IP::remote_addr]"}

 

Check if client IP is not in the UserDataGroup

 

if { [class match [IP::remote_addr] equals "UserDataGroup"] }{

 

if { $DEBUG } {log local0. "Client is in UserDataGroup"}

 

Prevent the HTTP_REQUEST event from firing if user is local

 

event HTTP_REQUEST disable

 

}

 

elseif { $DEBUG } {log local0. "Client is in NOT UserDataGroup"}

 

}

 

 

when HTTP_REQUEST {

 

switch -glob [string tolower HTTP::path] {

 

"/login.aspx" -

 

"/foo/login.aspx" -

 

"/bar/login.aspx" {

 

Reject login info from non sites

 

HTTP::respond 403 content "Logins only allowed from networks.\r\n"

 

}

 

}

 

}

That looks good. One small correction: you're missing the square braces around HTTP::path:

 

 

switch -glob [string tolower [HTTP::path]] {

 

 

Also be aware that it's really simple to bypass URI based checks like that on IIS:

 

 

http://devcentral.f5.com/Community/GroupDetails/tabid/1082223/asg/50/aft/30900/showtab/groupforums/Default.aspx31324

 

 

Aaron

I've corrected it the brackets. Thanks for the info on IIS.