For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Paul_Michals_10's avatar
Paul_Michals_10
Icon for Nimbostratus rankNimbostratus
Jan 21, 2011

"if" verses "elseif" - performance question

Hello F5 DevCentral,

 

 

This comming Sunday I am to perform some minor maintenance on some of our existing F5 BIG-IP Virtual Servers when I will be modifing their iRules.

 

 

The question I have is: is it beter, from a performance perspective, to use "elseif" statements instead of sequential "if" statements give that there is no default "else" no matter what way the iRule is written?

 

 

Here is (with actual information removed) the proposed iRule:

 

 

when HTTP_REQUEST {

 

if { [HTTP::uri] equals "/" } {

 

HTTP::redirect https://website.company.com/complicated_url

 

}

 

if { [matchclass [HTTP::uri] starts_with $::list1] } {

 

if { not [matchclass [IP::client_addr] equals $::internal_network] } {

 

reject

 

}

 

}

 

if { [matchclass [HTTP::uri] starts_with $::list2] } {

 

if { not (([matchclass [IP::client_addr] equals $::allowed_addressses])

 

or ([matchclass [IP::client_addr] equals $::internal_network])) } {

 

reject

 

}

 

}

 

}

 

 

Instead of the three outer "if"s would a set of "if", "elseif", "elseif" statements be faster?

 

 

Or are the diffferences insignificant?

 

 

Thanks in advance.
application delivery
dev
devops
iRules

2 Replies

  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Jan 21, 2011
    Here's a good article on optimizing iRules which covers if, elseif, and switch. I'd go with elseif here.

     

     

    http://devcentral.f5.com/Tutorials/TechTips/tabid/63/articleType/ArticleView/articleId/108/iRules-Optimization-101--01--if-elseif-and-switch.aspx

     

     

    Also, depending on your version, you might not need "$::" before your classes which would help performance.

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/CMPCompatibility.html

     

     

    Let me know if you have any questions.

     

     

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jan 21, 2011
    If those three checks are all mutually exclusive, I'd change the iRule so as few of checks are performed as possible. ie, if it's a request for / and you don't need to check for the IP addresses, either chain the checks in an if/elseif/elseif/else chain or use the return command to exit that iRule event in that iRule.

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/return

     

     

    Chris' suggestions are also good points to consider.

     

     

    Aaron