problem with findclass

Hello Al,

finclass does a hardcoded wildcard match of the string against each line of the datagroup. I don't think there is a way around this. Perhaps you could make a feature request through F5 Support to provide an option for glob or specific matching against just the first "field" of the datagroup. In the meantime, you could use a for loop and getfield to perform an exact match against the class:

 
 when RULE_INIT { 
  
     Create a test class (actually a list in this case).  This could also be defined as a class/datagroup. 
    set ::test_class [list {field1 value1} {field1* value1} {field2 value2} {field11 value11}] 
  
     Loop through the datagroup line by line. 
    foreach element $::test_class { 
  
        Log the current line. 
       log local0. "Current \$element: $element" 
  
        Compare the element against the string. 
        If the datagroup entry has a wildcard, it should be listed first in the string compare statement. 
       if {[string match -nocase [getfield $element " " 1] "field11"]}{ 
  
           Found a match, so log it and break out of the foreach loop. 
          log local0. "Matched \$element: $element.  Value: [getfield $element " " 2]. Exiting loop." 
          break 
       } 
    } 
 } 
 

Log output:

Rule : Current $element: field1 value1

Rule : Current $element: field1* value1

Rule : Matched $element: field1* value1. Value: value1. Exiting loop.

If you don't want wildcard matching, you can test with this version which doesn't have a wildcard in the datagroup:

 
 when RULE_INIT { 
  
     Create a test class (actually a list in this case).  This could also be defined as a class/datagroup. 
    set ::test_class [list {field1 value1} {field2 value2} {field11 value11}] 
  
     Loop through the datagroup line by line. 
    foreach element $::test_class { 
  
        Log the current line. 
       log local0. "Current \$element: $element" 
  
        Compare the element against the string. 
        If the datagroup entry has a wildcard, it should be listed first in the string compare statement. 
       if {[string match -nocase [getfield $element " " 1] "field11"]}{ 
  
           Found a match, so log it and break out of the foreach loop. 
          log local0. "Matched \$element: $element.  Value: [getfield $element " " 2]. Exiting loop." 
          break 
       } 
    } 
 } 
 

Rule : Current $element: field1 value1

Rule : Current $element: field2 value2

Rule : Current $element: field11 value11

Rule : Matched $element: field11 value11. Value: value11. Exiting loop.

Aaron