sys-cmd curl

sys-cmd curl sends an HTTP or HTTPS request to an address from the route table selected in WEB-CLI and shows the response. It is possible to see only the headers, only the status code, or all the details of the connection including TLS. It is used to check the health address of a backend, the response that a vService gives for a specific host name, or a redirect chain.

Command Summary

TR7 WEB-CLI · sys-cmd curl

# type curl and press Tab: a free parameter

admin@TR7LBWAF01> sys-cmd curl

<curl-parameter-1>

 

admin@TR7LBWAF01> sys-cmd curl <parameters> <address>

admin@TR7LBWAF01>  

Everything written after the word curl is passed to the tool as it is. There is no mandatory field; the address is written together with the parameters according to the tool's own syntax.

How It Works

Subject	Behavior
Context	The request is sent from within the selected v-device and route table; for a backend in an isolated route table, route-table set is run first.
Quotation	Headers with spaces are put in quotation marks. Addresses that contain & and values that contain $ are written with single quotation marks; an & written without quotation marks causes the line to be rejected with an Invalid command error.
File	The file written with -o does not land in the temporary file area; if the response body is to be kept, | to-file <name> is used.
Duration	It closes when the response is complete; on a target that does not respond, a limit is set with --max-time or it is stopped with Ctrl+C.
Recording	Every run is written to the user logs.

Frequently Used Parameters

Parameter	What it does	What is written after it
-I	Requests only the response headers	—
-i	Writes the response headers together with the body	—
-v	Writes the detail of the connection, the TLS handshake, and the request and response headers	—
-k	Skips the certificate verification; on backends with a self-signed certificate	—
-L	Follows the redirects	—
-H	Adds a header to the request	"Header: value" (e.g. "Host: shop.example.com")
-X	Changes the HTTP method	GET · POST · PUT · DELETE · HEAD
-d	Sends a request body	The body text, in single quotation marks
--resolve	Determines which IP address a name will go to without asking DNS	name:port:ip (e.g. shop.example.com:443:10.0.7.20)
-s	Hides the progress bar and the messages other than errors	—
-o · -w	-o /dev/null discards the body; -w writes the response information in the requested format	A format string such as '%{http_code}'
--max-time	Limits the total duration of the request	Seconds
--connect-timeout	Limits the connection establishment time	Seconds

The table summarizes frequently used parameters; the full list and behavior depend on the version of the tool on the device.

Examples

TR7 WEB-CLI · A) The status code of the backend health address

admin@TR7LBWAF01> sys-cmd curl -s -o /dev/null -w '%{http_code}' http://10.20.0.30/health

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) The response of the vService for a specific host name

admin@TR7LBWAF01> sys-cmd curl -I -H "Host: shop.example.com" http://10.0.7.20/

admin@TR7LBWAF01>  

TR7 WEB-CLI · C) An HTTPS vService by name, without asking DNS

admin@TR7LBWAF01> sys-cmd curl -v --resolve shop.example.com:443:10.0.7.20 https://shop.example.com/

admin@TR7LBWAF01>  

TR7 WEB-CLI · D) A backend with a self-signed certificate, with a 5 second limit

admin@TR7LBWAF01> sys-cmd curl -k --max-time 5 https://10.20.0.30:8443/health

admin@TR7LBWAF01>  

TR7 WEB-CLI · E) The redirect chain and an address with a query string

admin@TR7LBWAF01> sys-cmd curl -sIL 'http://10.0.7.20/login?next=/app&lang=tr'

admin@TR7LBWAF01>  

TR7 WEB-CLI · F) Only the server line from the response headers

admin@TR7LBWAF01> sys-cmd curl -sI http://10.0.7.20/ | grep Server

admin@TR7LBWAF01>  

Things to Know

• The difference between Connection refused and a timeout. Connection refused shows that the target was reached but there is no service on the port; a long wait and a timeout shows an obstacle on the way or on the target. For the path traceroute is used, and for the port nmap.
• The wrong certificate or the wrong site. If more than one domain name is offered on the same IP address, the request is sent with the name using --resolve instead of with the IP address; in this way both the server name and the Host header go correctly.
• A WAF block. If the WAF is enabled on the vService, the test request may be blocked; in this case the response is the WAF blocking page and it appears in the WAF logs.
• For all of the TLS versions and cipher suites sslscan is used.