For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

lostinberlin_11's avatar
lostinberlin_11
Icon for Nimbostratus rankNimbostratus
Jul 31, 2015

Strange behaviour list traffic policies

...can anyone explain this?

Searching with a wild-card does not return the correct values (see actions and conditions)

P-policy-admi*
vs
P-policy-admin

root@(localhost)(cfg-sync In Sync)(Standby)(/Common)(tmos) list /ltm policy P-policy-admi* all-properties
ltm policy P-policy-admin {
    app-service none
    controls { forwarding }
    hints none
    partition Common
    requires { http }
    rules {
        P-policy-admin_policy_rule {
            actions none
            app-service none
            ordinal 1
            conditions none
        }
    }
    strategy first-match
}
root@(localhost)(cfg-sync In Sync)(Standby)(/Common)(tmos) list /ltm policy P-policy-admin
ltm policy P-policy-admin {
    controls { forwarding }
    requires { http }
    rules {
        P-policy-admin_policy_rule {
            actions {
                0 {
                    forward
                    select
                    pool P-adminpool-9000
                }                                                                                                                                                                                                                                                      
            }                                                                                                                                                                                                                                                          
            conditions {
                0 {
                    http-uri
                    path
                    starts-with
                    values { /admin/services }
                }
            }
            ordinal 1
        }
    }
    strategy first-match
}

3 Replies

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus

    Possibly a shell expansion issue? With subsequent matches being treated as parameters to the command?

    Try single quotes around the wildcard item (Sorry, don't have an LTM running to verify ATM)

    list /ltm policy 'P-policy-admi*' all-properties
    

    H

  • Ah, I see what you mean now. Yes, it does appear that the wildcard removes some actions and conditions information from the response.

    [root@bigip116:Active:Standalone] config  tmsh list /ltm policy policy-test
    ltm policy policy-test {
        controls { forwarding }
        requires { http tcp }
        rules {
            foo-test {
                actions {
                    0 {
                        http-reply
                        redirect
                        location /bar
                    }
                }
                conditions {
                    0 {
                        http-uri
                        starts-with
                        values { /foo }
                    }
                }
                ordinal 1
            }
        }
        strategy first-match
    }
    [root@bigip116:Active:Standalone] config  tmsh list /ltm policy policy-*
    ltm policy policy-test {
        controls { forwarding }
        requires { http tcp }
        rules {
            foo-test {
                ordinal 1
            }
        }
        strategy first-match
    }
    

    Suffice it to say, good catch. 😉

    I don't think that's intentional so please do open a support case. In the meantime, I can think of at least workaround:

    tmsh list /ltm policy |grep -A 0 policy-.* | awk -F" " '{ print $3 }'
    

    to list the names of all policies matching your string pattern, and then perhaps a loop:

    for val in `tmsh list /ltm policy |grep -A 0 policy-.* | awk -F" " '{ print $3 }'`; do tmsh list /ltm policy $val; done
    

    Not the prettiest thing in the world, but it should work.