Forum Discussion

BunnyJunJun's avatar
BunnyJunJun
Icon for Altostratus rankAltostratus
Sep 27, 2022

iRule Checking for No Value

Hi All, Just want to check with the fellow community members if you all have any idea on how to use iRules to check for no value? Basically, I am crafting an iRule that search for all headers and s...
security
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Oct 27, 2022

    local0. goes to the LTM log:

    tail -f /var/log/ltm
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee

Something like this maybe:

when HTTP_REQUEST {
    foreach x [string tolower [HTTP::header names]] {
        if { ( $x starts_with "sec-ch" ) and ( [HTTP::header $x] eq "" ) } {
            log local0. "found empty sec-ch header"
        }
    }
}
BunnyJunJun's avatar
BunnyJunJun
Icon for Altostratus rankAltostratus
Sep 27, 2022

Hi Kevin,

Thanks! I did roughly the same, however, in your context, x has no value. It is not even a string. Hence, quite hard for me to further "manipulate" x.

I was thinking to concatenate it like those we do for typical coding. (i.e. var temp = "" + x, and temp will be a string with x valueless). Is this possible in terms of iRules?

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Sep 27, 2022

    x is the header name. Are you saying the header doesn't exist?

    • BunnyJunJun's avatar
      BunnyJunJun
      Icon for Altostratus rankAltostratus
      Sep 28, 2022

      Hi Kevin,

      Header exist. An example of the request captured would be as such.

      Header A: valueA
      Header B: valueB
      sec-ch-mobile: 
      Header C: valueC

      Given the idea of above, sec-ch-mobile has no value and it is not an empty string. As such, how do i check for x is an empty value given your sample iRules above?

      • Kevin_Stewart's avatar
        Kevin_Stewart
        Icon for Employee rankEmployee
        Sep 28, 2022

        Not sure I completely understand. the sec-ch-mobile header has no value and is not an empty string? I don't think it can be both of these. Try logging what the value actually is:

        when HTTP_REQUEST {
    foreach x [string tolower [HTTP::header names]] {
        if { $x starts_with "sec-ch" } {
            log local0. "header($x) == |[HTTP::header $x]|"
        }
    }
}

        I put the pipes in there to show if there's actually just white space. Still technically a non-empty string, not equal to "".