Hello, I am trying to check if a IP address is valid in the bigip with regexp (I don't know if anybody know other method). The regexp is the follow but don't work. Anybody can help me?. I need to check if the ip address is in the range 1-255 in the 4 octects. King regards, Mauro regexp \b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b

What is happening when you test your regex? Does it just not match, or do you get a TCL error in the LTM log file (/var/log/ltm). It is hard to see what you've used, as DC munges the characters. Here are two options from regexbuddy: I've attached them in a file in case DC munges the characters. Do you want to capture the match in backreferences? The first option doesn't use backreferences, the second one does: IP address Matches 0.0.0.0 through 255.255.255.255 Use this regex to match IP numbers with accuracy, without access to the individual IP numbers. \b(??:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b IP address Matches 0.0.0.0 through 255.255.255.255 Use this regex to match IP numbers with accuracy. Each of the 4 numbers is stored into a capturing group, so you can access them for further processing. \b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b Aaron

Your original version works for me. Here is a quick method to test. If you change ::ip_address to an invalid IP, no match is found. If it is valid, a match is logged. If the display of this regex is broken, you should be able to see it correctly by clicking reply and looking at the post. when RULE_INIT { set ::match {} set ::ip_address "256.2.3.4" set ::ip_address_regex {\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b} regexp $::ip_address_regex $::ip_address ::match log local0. "\$::ip_address: $::ip_address; matched: $::match" } Aaron

Hello Aaron, Thanks very much for your answer. When We applyed the Irule matched ip address out of range like as 400.400.400.400 and good ip address like as 100.100.100.100, but We don't receive any TCL error in /var/log/ltm. So after saw you last comment We think that We are using bad the if with the regexp, what do you think this is the coded used. One important note is that in the 4 octect Trash is added after the number for some motive, I suspect that for this reason don't work fine the regexp??. Also We want to the regexp detect not only ip address out of range and also string, or other special caracter as a invalid ip address, We think the regexp does it. King regards, Mauricio This is a code extract using the regexp when CLIENT_DATA { Capturamos la IP del Payload set vacio " " set IP "" set LoginIP "" set LoginIP "[findstr [TCP::payload] LOGIN-IP 10 MSISDN]" log local0. "LoginIP= $LoginIP" se verifica que el valor de LOGIN-IP es vacio if {$LoginIP= ""}{ log local0. "Pool por defecto" pool LDAP_IRULE_10} else { if { [regexp "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)" $LoginIP]}{ log local0."evaluada regular expresion = $LoginIP"

Can you replace the double quotes with curly braces {}? Can you post with some examples of the $LoginIP values and the matches that you're seeing? Thanks, Aaron

Helllo Aaron, I will try with {} so I see for example if I test with : 10.10.10.100 I receive in the F5 10.10.10.1000 or 100L in the last octect. So I capture the Ip from the TCP playload and is not a IP filed the IP came from string parameter. This is I need to validate : ldapsearch -h ip_virtual f5 -p 389 -b o=SIUX "LOGIN-IP=X.X.X.X" MSISDN the x.x.x.x is that I need to check if a valid ip address and is not a caracter. King regards, Mauricio

Validate IP address with regexp

13 Replies

Thomas_Schaefer
Nimbostratus
May 08, 2009
Does anyone have an idea why this would not work with 209.162.186.60 pulled from a string? I am executing this statement:

set a "209.162.186.60"

log local0. "catch $a => [catch {IP::addr $a mask 255.255.255.255} ]"

log local0. "catch $hostname => [catch {IP::addr $hostname mask 255.255.255.255} ]"

log local0. "hostname = \[$hostname>\]"

$hostname was pulled from a header using set hostname [HTTP::header "X-HOSTNAME"].

This is the result of the log:

Rule OutboundSSLRouter HTTP_REQUEST: catch 209.162.186.60 = 1

Rule OutboundSSLRouter HTTP_REQUEST: catch 209.162.186.60 = 0

Rule OutboundSSLRouter HTTP_REQUEST: catch 209.162.186.60 = 1

Is there anything special about a variable pulled from HTTP::header?
Luke_Lehman
Employee
Feb 23, 2011
I'm seeing what looks like the same problem the above poster is seeing. I'm base64 decoding a portion of the URI, and the catch sees an exception with the decoded variable value, but doesn't have an exception from a recently declared string value:

set a 256.256.256.256

set b 192.168.199.156

set c 192.168.199.157

if {[catch {b64decode $query_b64encoded_member_ip} b64decoded_member_ip] == 0 and $b64decoded_member_ip ne ""}{

base64 decoding succeeded

if { $::debug } {log local0. "b64 decoding successful: $b64decoded_member_ip"}

}

log local0. "catch $a => [catch {IP::addr $a mask 255.255.255.255} ]"

log local0. "catch $b64decoded_member_ip => [catch {IP::addr $b64decoded_member_ip mask 255.255.255.255} ]" log local0. "catch $b => [catch {IP::addr $b mask 255.255.255.255} ]"

log local0. "catch $c => [catch {IP::addr $c mask 255.255.255.255} ]"

Logged Output:

Rule gen_iRule : b64 decoding successful: 192.168.130.156

Rule gen_iRule : catch 256.256.256.256 => 1

Rule gen_iRule : catch 192.168.199.156 => 1

Rule gen_iRule : catch 192.168.199.156 => 0

Rule gen_iRule : catch 192.168.199.157 => 0

You can see that the .156 address from the base64 decoded value fails the IP:addr check, whereas the pure string variable $c passes fine.

Curious.
hoolio
Cirrostratus
Feb 25, 2011
Hi Luke,

I'm not sure what would cause this. Can you open a case with F5 Support and reply back here with the case number? I'm interested to see what happens.

Thanks, Aaron