# 20 Lines or Less # 42 – Secret list … OF DOOM **URL:** \ **Category:** F5 Technical Articles\ **Tags:** irules, dev, ssl, 20-lines-or-less, security, devops, application-delivery, 20lines, hardware, http, us\ **Created:** [December 9, 2010, 3:07pm UTC](https://community.f5.com/t/20-lines-or-less-42-ndash-secret-list-hellip-of-doom/63863 "2010-12-09T15:07:23Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Colin\_Walker\_12](https://avatars.discourse-cdn.com/v4/letter/c/a88e4f/32.png) [@Colin\_Walker\_12](https://community.f5.com/u/Colin_Walker_12)\ **Post date:** [December 9, 2010, 3:07pm UTC](https://community.f5.com/t/20-lines-or-less-42-ndash-secret-list-hellip-of-doom/63863/1 "2010-12-09T15:07:23Z")
_What could you do with your code in 20 Lines or Less?_ That’s the question I ask (almost) every week for the [devcentral](http://devcentral.f5.com/s) community, and every week I go looking to find cool new examples that show just how flexible and powerful iRules can be without getting in over your head. This week I bring to you two cool iRules from the forums and one from a secret squirrel internal mailing list OF DOOM!!!. Okay, maybe not of doom, but it’s a list with some wicked smart people on it and I’m lucky to get to harvest good stuff out of there sometimes. We’ll cover handling HTTP and HTTPS on a single VIP, stream matching TCP data, and HTTP rate limiting with the table command in yet another variation. **TCP Payload Matching and Logging** [http://bit.ly/efMH9z](http://bit.ly/efMH9z) User mattrm was kind enough to post back to this thread started a few months back to show us exactly how he got this stream match solution working in his environment.  A very cool example of how to search and replace a string in-line.  In this case he’s dealing with straight TCP traffic, but just about any non encrypted traffic (including traffic decoded on the LTM) would work.  Using the stream profile:   @Username.\*Userpassword=\n@@  : > when STREAM\_MATCHED { >   # log each match found by the stream filter >   scan [STREAM::match] “Username=%s” user >   log local0. “Username [b64decode $user] had password replaced” >   STREAM::replace “Username=$user\nUserpassword=0000=\n” > } > > when LB\_SELECTED  {        > set serverIP [LB::server addr] > log local0. “LB Server IP $serverIP” > } **Selective HTTP redirection based on SSL** [http://bit.ly/g6bCbG](http://bit.ly/g6bCbG) In this interesting iRule user Dave Hatfield is looking to redirect traffic that is not using SSL to an HTTPS link, while dealing with non SSL traffic differently, but on the same virtual and in the same iRule.  That poses an interesting problem of identifying SSL vs non SSL traffic in a single virtual / iRule. There are a couple of ways to go about this, and I think he chose a solid one. Simple and easy to follow, yet effective.  Cool stuff. > when CLIENT\_ACCEPTED { >         # Set a variable to track whether this is an HTTPS request >         set https 0 > } > when CLIENTSSL\_HANDSHAKE { >         # There was a client side SSL handshake, so update the variable  >         set https 1 > } > when HTTP\_REQUEST { >         # Check if referrer is eschool >         if {!([HTTP::header “Referer”] starts\_with “[https://eschool.mysite.org/webapps/](https://eschool.mysite.org/webapps/)”)}{ >             # If there is no URI redirect to portal >              if {[HTTP::path] eq “/” }{ >                  HTTP::redirect “[https://portal.mysite.org/eschool](https://portal.mysite.org/eschool)” >              } > } >         if {not ($https)}{ >         # If it’s not an HTTPS connection, send a redirect >               HTTP::redirect https://[HTTP::host][HTTP::uri]  >         } > } **HTTP Request limiting via tables** One of the engineers here at F5, Christian Koenning spawned a cool example iRule showing off how to achieve a stable 3000 requests per second threshold by making use of the table command and some logic inside an iRule.  The illustrious Kirk Bauer then tweaked it a bit and twisted it into an HTTP example, which is what I’m posting below. > when HTTP\_REQUEST timing on { >    set request\_limit\_reached [table lookup “request\_limit\_reached”] >    if { [expr [table incr “counter\_all\_requests”] % 15] == 0 } { >       if { $request\_limit\_reached \< 2 } { >           set request\_limit\_reached [table incr “request\_limit\_reached”] >           table timeout “request\_limit\_reached” 1 >           table lifetime “request\_limit\_reached” 1 >       } >    } >    if { $request\_limit\_reached \>= 2 } { >       HTTP::respond 500 >    } > } There we go, another three killer iRules in less than 21 lines.  Thanks as always to the community for doing that thing you do. Keep on rockin’, and posting those iRules. If you have any questions or comments, never hesitate to drop me a line. #Colin ---
**Author:** ![NULL1981\_174998](https://avatars.discourse-cdn.com/v4/letter/n/96bed5/32.png) [@NULL1981\_174998](https://community.f5.com/u/NULL1981_174998)\ **Post date:** [October 23, 2014, 7:41pm UTC](https://community.f5.com/t/20-lines-or-less-42-ndash-secret-list-hellip-of-doom/63863/2 "2014-10-23T19:41:50Z")
E=MC^2\*~[x×x+x-x÷x+1]=[x×x+x÷x-x]or {E=MC^2=E=MC^2} when @ same calculated speed in different dimensions as off 10th Dimension or any Dimensions is and can be pelucidised by E=MC^2 formula where speed and shine of light can be measured and can be bent with and by optical fibre or microscope and magnifying glass and mirrors