Forum Discussion
NimbostratusiRule syntax - need help with conditional statement
Hi all, I wanted to know if I could request some help with checking if my syntax for something is correct.
This is what I'm trying to write:
If http header keep-alive is true and http header accept is false then match this (whatever it is). This is how I wrote it in the iRule:
if {([[HTTP::header "keep-alive"] eq "true" and [HTTP::header "Accept"] eq "false"]) matches_regex {([0-9]+)} }
Would my if statement work?
Thanks for any help in advance!!!
6 Replies
- Kevin_Stewart
Employee
Not sure I'm following your requirement. The Keep-Alive and Accept headers wouldn't normally contain "true" or "false" string values. What are you trying to match with the matches_regex command?
Patti_G_72768Hi Kevin, I have a rule that I need to translate into an iRule. Part of the rule had the following:
That's why I thought in the iRule I would need to place the http header accept to false and http header keep-alive to true. I probably didn't interpret it correctly. Sorry!
- Kevin_Stewart
I have to assume there's more to that statement? Would you interpret to say, if the Accept header doesn't exist, the Keep-Alive header does exist, and the Keep-Alive header value is a number? What is supposed to do these criteria match?
- Patti_G_72768
Hi Kevin, there is one more piece of info I forgot to include. It is:
This came after the regex statement.
sorry again!
Hulk_Smash_1363Actually, here's what we're trying to do Kevin. We are trying to find the best approach to mitigate a HULK HTTP Denial of Service attack. It seems like this type of DoS attack has some unique characteristics that may or may not be covered by the DoS profile properties in the ASM. From what I have gathered, this particular type of attack generates unique requests by changing the user agent, the referrer, and the keep alive time. Perhaps you already know more about this. We were using a WAF from another provider that constructed the rule as follows:
HULK Attack CUSTOM-HULK-DOS-TOOL-v1 609634 %(WAF_CUSTOM_R609634_DENY) 403And what we are trying to figure out is if this will require a custom irule, if there is a signature that will address this, or can this be addressed with the DoS profile parameters within a DoS profile.
