For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

J_Drew_160974's avatar
J_Drew_160974
Icon for Nimbostratus rankNimbostratus
Jun 16, 2014

How to use an Irule switch to match HTTP::host and HTTP::uri?

Hi

I could use some advice about an irule that is not working for me. I have sanitised the urls.

I have no control over the URL's of the hosted applications. As you can see the HTTP::host needs to be matched in order to determine if it a live or test app being requested. The HTTP::uri needs to be matched in order to determine which app is needed. the customer has a load of web forms that they use behind the /* match... and so the actual default is unlikley to be used unless the client types something odd. I also have no control over the odd fact that app2 is access via a client via app2easypath, yet the website is on /realpath.

What seems to be happening is when we try to go to "www.testapp.customer.co.uk/app2easypath/" we end up being redirected to the default website.

Any help on where i have gone wrong would be great. Thanks J ........ rule IRULE-CUST1-WEB-PROD-SSL

when HTTP_REQUEST {
    switch -glob [string tolower [HTTP::host][HTTP::uri]] {
        “www.liveapp.customer.co.uk/app1" { 
            pool CUST1-WEB-PROD-APP1-Pool 
            SSL::disable serverside
        } 
        “www.testapp.customer.co.uk/app1" { 
            pool CUST1-WEB-PROD-APP1-test-Pool 
            SSL::disable serverside
        } 
        "www.liveapp.customer.co.uk/app2easypath" { 
            pool CUST1-WEB-PROD-APP2-Pool 
            SSL::disable serverside 
            HTTP::path [string map { /app2easypath /realpath } [HTTP::path]] 
        }
        "www.testapp.customer.co.uk/app2easypath" { 
            pool CUST1-WEB-PROD-APP2-test-Pool 
            SSL::disable serverside 
            HTTP::path [string map { /app2easypath /realpath } [HTTP::path]]
        }
        "www.liveapp.customer.co.uk/" { 
            pool CUST1-WEB-PROD-Default-Pool 
            SSL::disable serverside
        } 
        "www.testapp.customer.co.uk/" { 
            pool CUST1-WEB-PROD-Default-Pool 
            SSL::disable serverside
        } 
        default {
            HTTP::redirect http://www.google.com
        } 
    } 
}

 

application delivery
BIG-IP Access Policy Manager (APM)
design
devops
iRules
LTM
security

3 Replies

  • mimlo_61970's avatar
    mimlo_61970
    Icon for Cumulonimbus rankCumulonimbus
    Jun 16, 2014

    If you put a tab before you paste in your code, it will format it nicer for everyone to look through.

     

    I think you are missing a trailing / in you switch for "www.testapp.customer.co.uk/app2easypath"

     

  • Cory_50405's avatar
    Cory_50405
    Icon for Noctilucent rankNoctilucent
    Jun 16, 2014

    I'd suggest putting a logging statement in your problematic match clause and verify what you are expecting to see in the log:

     

    when HTTP_REQUEST { 
 switch -glob [string tolower [HTTP::host][HTTP::uri]] {
  "www.liveapp.customer.co.uk/app1" {
    pool CUST1-WEB-PROD-APP1-Pool 
    SSL::disable serverside
  } 
  "www.testapp.customer.co.uk/app1" {
    pool CUST1-WEB-PROD-APP1-test-Pool 
    SSL::disable serverside
  } 
  "www.liveapp.customer.co.uk/app2easypath" {
    pool CUST1-WEB-PROD-APP2-Pool 
    SSL::disable serverside 
    HTTP::path [string map { /app2easypath /realpath } [HTTP::path]]
  }
  "www.testapp.customer.co.uk/app2easypath" {
    pool CUST1-WEB-PROD-APP2-test-Pool 
    SSL::disable serverside 
    HTTP::path [string map { /app2easypath /realpath } [HTTP::path]]
    log local0. "Request to the server is [HTTP::host][HTTP::uri]"
  }
  "www.liveapp.customer.co.uk/" {
    pool CUST1-WEB-PROD-Default-Pool 
    SSL::disable serverside
  }
  "www.testapp.customer.co.uk/" {
    pool CUST1-WEB-PROD-Default-Pool 
    SSL::disable serverside
  }
  default { HTTP::redirect http://www.google.com} }
  }
}

     

  • Matt_Breedlove_'s avatar
    Matt_Breedlove_
    Icon for Nimbostratus rankNimbostratus
    Jun 16, 2014

    It looks like either the HTTP Host may be having the destination TCP port appended on the end of the hostname and so, failing to match the switch tests. It could also be a trailing slash on the end of the URI of app2easypath.

    I have optimized your switch call to avoid getting tripped up with trailing HTTP HOST port info and I added an asterisk wildcard to a couple of the tests. If it is just the hostname with trailing port info you can remove the asterisk in the hostname/uri match at the end of the URI.

    Also your sequence order of actions was not right. First the HTTP operations need to be done, then you can pool the connection which will essentially stop irule processing so if you want to disable SSL serverside you should probably do that before the pool as well (as shown below)

     

    
when HTTP_REQUEST { 
    switch -glob [string tolower [getfield [HTTP::host] ":" 1][HTTP::uri]] {
        "www.liveapp.customer.co.uk/app2easypath_" {
            HTTP::path [string map { /app2easypath /realpath } [HTTP::path]] 
            SSL::disable serverside
            pool CUST1-WEB-PROD-APP2-Pool
        }
        "www.testapp.customer.co.uk/app2easypath_" { 
            HTTP::path [string map { /app2easypath /realpath } [HTTP::path]] 
            SSL::disable serverside
            pool CUST1-WEB-PROD-APP2-test-Pool
        }
        default {
          HTTP::redirect http://www.google.com
        } 
    }
}