For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

warlock's avatar
warlock
Icon for Nimbostratus rankNimbostratus
May 22, 2020

Irule for layer 7 policy | Stream

i am doing layer 7 load balancing based on the URI. I have the below script i rule which works fine for the one VIP one URL but now since there is layer 7 policy applied i want irule to run only if t...
cjunior's avatar
cjunior
Icon for Nacreous rankNacreous
May 27, 2020

Hello,

You can combine LTM policy + iRule to insert content to certain policy rule condition.

e.g.

LTM Policy:

rule1

  Condition:

  "HTTP URI" "full string" "is" "any of" "/my_path_to_reqwrite" at "request" time.

  Action:

  "Set variable" named "doInsertScriptRule" equal to "1" at "request" time.

"Forward traffic" to "pool" "pool_1" at "request" time.

rule2

  Condition:

  "HTTP URI" "full string" "is" "any of" "/other_paths" at "request" time.

  Action:

"Forward traffic" to "pool" "pool_2" at "request" time.

LTM iRule:

when HTTP_REQUEST {
  if { [info exists doInsertScriptRule] } {
    HTTP::header remove "Accept-Encoding"
  }
  STREAM::disable
}
when HTTP_RESPONSE {
  if { [info exists doInsertScriptRule] && [HTTP::header value Content-Type] contains "text" } {
    set search "<head>"
    set replace "<head><script>"
    STREAM::expression @$search@$replace@
    STREAM::enable
  }
  unset -nocomplain doInsertScriptRule
}

The [info exists variable] check if variable was set before. 

As LTM policy runs first, it's possible to check for that variable on iRule.

It means that if you don't set a variable in LTM policy, the iRule will not run the string search/replace, than, you must set the variable only for URI you need to.

Best regards