Forum Discussion
jksingh_44237
Nimbostratus
Nov 04, 2011mysql db pool configuration in F5
I have to put two mysql servers behind the F5 to balance the mysql db traffic for web servers... I have created the pool for two node & added for virtual also.... But facing the issue to establish the...
Hi,
I'd go back to using a stream profile and STREAM::expression iRule. While you can't use positive lookaheads, you can modify your stream expression to match more of the source string than you need to replace and then inspect the match and customize the replacement in the STREAM_MATCHED event using STREAM::match and STREAM::replace. Here are the related wiki pages for the commands. You can check the STREAM::expression page for an example of the rewriting in STREAM_MATCH:
http://devcentral.f5.com/wiki/default.aspx/iRules/stream
http://devcentral.f5.com/wiki/default.aspx/iRules/stream__expression
This example shows how you can use STREAM::match in the STREAM_MATCHED event to check if the matched string meets some condition that can't easily be checked for using a single regex in STREAM::expression.
when HTTP_REQUEST {
Disable the stream filter for all requests
STREAM::disable
}
when HTTP_RESPONSE {
Check if response type is text
if {[HTTP::header value Content-Type] contains "text"}{
Match an http://*example.com string and replace it with nothing yet
STREAM::expression {&http://.*?example\.com&&}
Enable the stream filter for this response only
STREAM::enable
}
}
when STREAM_MATCHED {
Check if the matched string meets some condition that can't easily be checked for using a single regex in STREAM::expression
if {[STREAM::match] starts_with "host1"}{
Replace http:// with https:// and do the replacement
STREAM::replace "[string map {http:// https://} [STREAM::match]]"
log local0. "[IP::client_addr]:[TCP::local_port]: matched: [STREAM::match], replaced with: [string map {http:// https://} [STREAM::match]]"
}
}
Aaron
- Yoann_Le_Corvi1Jan 23, 2020
Cumulonimbus
Hi
The short answer is (unfortunately) : it depends ! :)
It depends how strict you want to be on the policy, and how much time you have available for the job.
Always : once policy is stabilized, wildcard is removed any parameter not in the list will be blocked.
Selective : wilcard remains, paramters are allowed, but if you have to relax a setting (e.g. disable an attack signature) this will be applied only to the relevant parameter and not to all of them
Never : wildcard remain, and if you relax a setting (e.g. disable an attack signature) this will be applied to the wildcard, i.e. all parameters.
So no real "rule" unfortunately.
Hope this helps in the reflexion ?
Yoann