# iRules if / switch / class builder > Describe one decision as rules and get it written as an if / elseif chain, a switch and a class match with its tmsh data groups, then see which pool each picks for a test value. Shows where first match and longest match disagree. Local, no network. - Tool: https://ronutz.com/en/tools/f5-irules-conditional-builder - Family: Networking --- ## What it does Describe one decision as ordered rules ("paths starting with /api go to api_pool, /login goes to login_pool, everything else to web_pool") and the tool writes it three ways: - an `if` / `elseif` chain, - a `switch` (with `-glob` when a rule needs it, and `--` before the value), - a `class match` lookup on data groups, with the `tmsh` definitions of the data groups. A test value then runs through each generated rule in the teaching interpreter, and the page shows which pool each form chose. ## Why the forms can disagree `if` and `switch` take the **first** rule that matches, in the order written. `class match` with `starts_with` or `ends_with` returns the **longest** matching entry, whatever the order (F5's `class` reference says so). With rules `/api` and `/api/v2`, the test value `/api/v2/users` goes to `api_pool` through `if` and `switch`, but to `api_v2_pool` through `class match`. The tool also flags a rule that can never fire because an earlier rule always matches first. ## Worth knowing - Lower-casing the value (`string tolower`) makes the comparison case-insensitive, but then a rule value with capitals can never match; the tool warns about that. - `class match` has no glob comparison, so a glob rule rules out the data-group form. - A rule value with a brace that has no partner is written with a backslash in front (`\{`). Tcl counts the braces inside a braced body even between double quotes (rule 5 of the Tcl 8.4 syntax page), so a lone one would break the rule; real Tcl 8.4.6 stops with `missing close-brace`. - For `HTTP::path`, a test value is cut at its first question mark: `HTTP::path` does not include the query string (F5's `HTTP::path` reference), so the rules compare only the part before it. - Record names with characters other than letters, digits and `_ . / : -` are written in double quotes in the `tmsh` definitions. That quoting has not been tried on a BIG-IP: list the data group in `tmsh` after creating it and check the records. - The generated code follows the DevCentral iRules Style Guide (4-space indents, a priority on the event, braced expressions, braced variable names, `--` on `switch` and `class`), and it passes this site's style checker with no findings. ## Sources - [F5 iRules reference: class](https://clouddocs.f5.com/api/irules/class.html) (read 2026-10-02) - [F5 iRules reference: Operators](https://clouddocs.f5.com/api/irules/Operators.html) (read 2026-10-02) - [Tcl 8.4 manual: switch](https://www.tcl-lang.org/man/tcl8.4/TclCmd/switch.htm) (read 2026-10-03) - [F5 K15650046: Tcl code injection security exposure](https://my.f5.com/manage/s/article/K15650046) (read 2026-10-03) - [F5 DevCentral: iRules Style Guide](https://community.f5.com/t/irules-style-guide/71151) (read 2026-10-03) - [F5 iRules reference: priority](https://clouddocs.f5.com/api/irules/priority.html) (read 2026-10-03) - [F5 iRules reference: HTTP::path](https://clouddocs.f5.com/api/irules/HTTP__path.html) (read 2026-10-03) - [Tcl 8.4 manual: Tcl (the substitution rules)](https://www.tcl-lang.org/man/tcl8.4/TclCmd/Tcl.htm) (read 2026-10-03) ## Standards and references - [F5 iRules reference: class](https://clouddocs.f5.com/api/irules/class.html) - class match and class search operators and options; starts_with and ends_with return the longest matching entry - [F5 iRules reference: Operators](https://clouddocs.f5.com/api/irules/Operators.html) - the Tcl operators by precedence and the operators F5 adds: contains, ends_with, equals, matches_glob, matches_regex, starts_with, and, not, or - [Tcl 8.4 manual: switch](https://www.tcl-lang.org/man/tcl8.4/TclCmd/switch.htm) - the -exact, -glob, -regexp and -- options, fall-through bodies, default, and comments only inside bodies - [F5 K15650046: Tcl code injection security exposure](https://my.f5.com/manage/s/article/K15650046) - always brace expressions; always put -- before the switch string; the bad option error a value starting with - produces - [F5 DevCentral: iRules Style Guide (JRahm with Jim_Deucker, 2022-12-22)](https://community.f5.com/t/irules-style-guide/71151) - the editor settings and the numbered rules R1 to R20 the checker reads an iRule against - [F5 iRules reference: priority](https://clouddocs.f5.com/api/irules/priority.html) - event priority runs from 0 to 1000, defaults to 500, and lower numbers run first - [F5 K6091: The version of Tcl used to develop iRules](https://my.f5.com/manage/s/article/K6091) - the iRules command set was developed from Tcl base version 8.4.6, which is used in all BIG-IP versions; the engine models that version - [F5 iRules reference: HTTP::path](https://clouddocs.f5.com/api/irules/HTTP__path.html) - HTTP::path returns the path part of the request and does not include the query string - [Tcl 8.4 manual: Tcl (the substitution rules)](https://www.tcl-lang.org/man/tcl8.4/TclCmd/Tcl.htm) - quotes allow substitution, braces prevent it, brackets run a command, and each character is processed exactly once; inside braces, braces nest and a brace quoted with a backslash is not counted, even between double quotes ## Related reading - [iRules: choosing between if, switch, class match, and static arrays](https://ronutz.com/en/learn/irules-branching-and-lookups.md): When an iRule has to match one value against many and act, there are four common tools: chained if, switch, a data group with class match, and a directly-indexed static:: array. F5 has actually ranked them for speed. Here is that ranking, and the two questions that decide which one you should reach for. - [The DevCentral iRules Style Guide, rule by rule, with the reasons](https://ronutz.com/en/learn/irules-style-guide-explained.md): F5's DevCentral published an iRules Style Guide in 2022: editor settings and twenty numbered rules. Some are taste, but several prevent real failures: an iRule that will not load, a switch an attacker can steer, an expression that runs request data as code, a log storm. Here are the rules grouped by what they protect, with the reason behind each, what the comment thread under the guide corrected, and what has changed since it was written.