Jump to content
Welcome to our new Citrix community!

cs policy exact match url


Wangqiang Shuai

Recommended Posts

 


i have a question about  ,how to use cs policy exact match url
eg :

http://abc.com/xx

http://abc.com/xx/

http://abc.com/xxx

http://abc.com/xxx/cc.html


i have create  two  cs policys, first  is  HTTP.REQ.URL.PATH.STARTSWITH("/xx") prio 100  , secondary  is   HTTP.REQ.URL.PATH.STARTSWITH("/xxx") prio  110,

when i curl http://abc.com/xxx ,it only hit first?
 
 thanks

Link to comment
Share on other sites

Priority 100 is processed before 110; first matching policy wins.

As Ross mentioned. So when your criteria overlaps, you have to have your most restrictive policies bound priority first over the more generic ones.

(The older style "url" based policies, processed on longest match; but you are using expression based, so you have to manipulate the priorities).

 

 

 

Link to comment
Share on other sites

What exactly do you want to do?

If you want to match where a URL exactly equals something, just use http.req.url.path.eq("...")

While you could use regex_match, it a more a costly evaluation that http.req.ulr.path.eq orhttp.req.url.path.contains, .starts_with, .get(1) should all be fine for your cases.

23 hours ago, Wangqiang Shuai said:

 


i have create  two  cs policys, first  is  HTTP.REQ.URL.PATH.STARTSWITH("/xx") prio 100  , secondary  is   HTTP.REQ.URL.PATH.STARTSWITH("/xxx") prio  110,

when i curl http://abc.com/xxx ,it only hit first?
 
 thanks

 

Are you looking at four different matches that need their own behvaior or are you looking at an OR condition?

The exact recommendation would vary, depending on what URL patterns you are expecting and what happens to other URLs not yet defined.

 

Based on your original post with these potential samples:

http://abc.com/xx

http://abc.com/xx/

http://abc.com/xxx

http://abc.com/xxx/cc.html

 

policy1:  http.req.url.path.set_text_mode(ignorecase).get(1).eq("xxx")   Priority 100  # make this one first

policy2:  http.req.url.path.set_text_mode(ignorecase).get(1).eq("xx")     Priority 110

 

In this case, http.req.url.path.get(1), gets the first element of a url path between the first two slashes. But it will be undefined for path exactly eq to "/"

http://abc.com/dir1/dir2/demo.cgi?a1=b1 will match "dir1"

So by changing your expression from .starts_with() or contains() to get(1).eq, you can clearly distinguish "xx" from "xxx" and prioriy won't matter; but still a good idea to put the more specific one first (in case future expressions change.

 

If you use http.req.url.path.starts_with("xx") then both /xx/ and /xxx/ match and you would have to change the prioritie for more specific match first like so, to get the results you intend:

http.req.url.path.set_text_mode(ignorecase).startswith("/xxx")  Priority 100

http.req.url.path.set_text_mode(ignorecase).startswith("/xx")  Priority 110

 

while you can use a regex-based operator, it shouldn't be needed. Any of the above should do what you want, with the information provided so far just to distinguish "/xxx<stuff>" from /xx/<stuff>

 

Edit:  If you need to treat "/xx" differently than "/xx/" then I would use a different comparison operator.

Edited by Rhonda Rowland
Added note.
Link to comment
Share on other sites

On 2/21/2020 at 6:34 AM, Wangqiang Shuai said:

can we use http.req.url.regex_match  to  exact match url  contains  xx   xx\    xxx   xxx\

 

Don't use regex_match if you can avoid. I would rather use HTTP.REQ.URL.EQ ("/xx")

 

In terms of CPU, EQ is better than BEGINS_WITH, ENDS_WITH. They are better than CONTAINS. This is mainly true for short strings, as they evaluate true or fals easily.


These commands are highly optimized and recommended fort general use. REGEX_MATCH is intended to be used with things you could not do using built in commands.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...