For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

aniaz_161592's avatar
aniaz_161592
Icon for Nimbostratus rankNimbostratus
Sep 20, 2014

Irule for different URL's to one URL

I have running with multiple url's as mentioned below under one VIP:

 

https://www.abc.com/abc/service/ https://www.abc.com/def/service/ https://www.abc.com/ghi/service/ https://www.abc.com/jkl/service/

 

I want only one URL will work which is https://www.abc.com/abc/service/ and all other's would be reject, what will be the irule in this case also please note in irule all other three url's must not redirect to https://www.abc.com/abc/service/ just reject. Thanks !!

 

7 Replies

  • Hi Aniaz,

    Here is untested rule that could you could start with

    when HTTP_REQUEST {
       Makes sure that host and uri are lower case
       set host [string tolower [HTTP::host]]
       set uri [string tolower [HTTP::uri]]
    
    if { $host eq "www.abc.com" } {
        if {!($uri starts_with "/abc/service/") } {
             Reject the request if it doesn't start with /abc/service/
            reject
            } else {
            return
       } else {
            reject it if it does not match www.abc.com
           reject
       }
    }
    

    I hope this helps

  • If I may add, since you're only evaluating the host and URI once, you can save yourself a little bit of memory and CPU cycles by skipping the variable creation:

    when HTTP_REQUEST {
        if { ( [string tolower [HTTP::host]] eq "www.abc.com" ) and ( [string tolower [HTTP::uri]] starts_with "/abc/service/" ) } {
            return
        } else {
            reject
        }
    }
    
  • Thanks for the reply, kindly do let me know one more thing if my "URI" having capital and lower case then what would be the impact of using "string tolower".

     

  • It is because, as Bhattman states, iRules (the string command in particular) honors the case of the input value.

    TesT != tEst
    

    For that reason, a function like [string tolower ] will "normalize" the data before performing evaluations.

    [string tolower "TesT"] == "test"
    

    You could also use [string toupper ]

    [string toupper "TesT"] == "TEST"
    

    In lieu of normalization, you'd have to evaluate every possible case variation that the user might submit.

    $var = "Test?"
    $var = "TEst?"
    $var = "TESt?"
    $var = "TEST?"
    $var = "tEST?"
    $var = "teST?"
    ...
    

    This string normalization function will cost you a CPU cycle or two, but it certainly beats the alternative search of every possible user submitted combination.

  • If the user sends this:

    /This/UrL/sAmPle
    

    Then the following evaluation will not match:

    if { [HTTP::uri] equals "/this/url/sample" } 
    

    If you normalize the input with [string tolower ] however, it will match:

    if { [string tolower [HTTP::uri]] equals "/this/url/sample" }
    

    If you don't normalize the input, you must attempt to evaluate the user's input value in the exact same case as entered.

    if { [HTTP::uri] equals "/This/UrL/sAmPle" }
    

    Of course if you do that, you'll likely have to expand that evaluation to many different case combinations. The [string tolower ] command does not change the case of the URI value submitted to the backend server, it is simply used to normalize the data for evaluation only. If, however, you absolutely need to evaluate input based on case, then that would be a use case for not using [string tolower ]:

    switch [HTTP::uri] {
        "/This/UrL/sAmPle" { pool a-pool }
        "/THis/UrL/sAmPle" { pool b-pool }
        "/THIs/UrL/sAmPle" { pool c-pool }
        "/THIS/UrL/sAmPle" { pool d-pool }
        "/THIS/URL/sAmPle" { pool e-pool }
        "/THIS/URL/SAmPle" { pool f-pool }
    }
    
  • Hello all I got same request as aniaz but with 2 urls which needs to be displayed and rest rejected: www.abc.com/test/world/saml-2.0 www.abc.com/test/world/test/saml-2.0 Can you help me guys with this

     

  • This irule could do the trick

    when HTTP_REQUEST { 
        if { ( [string tolower [HTTP::host]] eq "www.abc.com" ) } { 
            if { ( [string tolower [HTTP::uri]] starts_with "/test/world/saml-2.0" ) or ( [string tolower [HTTP::uri]] starts_with "/test/world/test/saml-2.0" ) } { 
            return
            } else {
            reject
            }
        }
    }
    

    Cheers, Kees