Error on LTM with getting IP from data group in an IRULE

Hello Tony,

Thoughts on the XFF header:

1. Contents of X-Forwarded-For are not guaranteed to be valid or accurate IP addresses.
2. Multiple headers are possible in a single request.
3. If a single XFF header contains multiple addresses, it will likely be comma-space delimited e.g.

   1.1.1.1, 2.2.2.2

   though not guaranteed.
4. It is possible to have a combination of multiple XFF headers with some containing multiple addresses.
5. The X-Forwarded-For header can be inserted by anyone with any address they choose. It is important to understand filtering by XFF does not provide security.

If possible, it would be preferable if a custom header colud be added similar to what CDNs do, e.g.

True-Client-IP

, to reduce the chance of anomalous values from occuring.

Parsing IPs from X-Forwarded-For

When using the method:

[getfield [HTTP::header values X-Forwarded-For] " " 1]

which is similar to:

[lindex [HTTP::header values X-Forwarded-For] 0]

you may end up with something like:

1.1.1.1,

which is not a valid IP causing a TCL error. What I have done in the past

I'll be honest, I'm not 100% clear on your 2nd objective, but here is a possible rule based on my interpretation. This may not be the most efficient rule, but it should help to reduce the number of TCL error you may encounter and maybe point you in the right direction.

when HTTP_REQUEST {
    if {[class match [HTTP::uri] starts_with DG-ALLOWED-URI-LIST]} {
         this is a secure URI

         check the real source IP
        set MATCH [class match [IP::client_addr] equals DG-ALLOWED-IP-XFF]

         cycle the X-Forwarded-For headers
        foreach HDR [HTTP::header values X-Forwarded-For] {
            if {$MATCH} { break }
             format the X-Forwarded-For header into a valid TCL list
            foreach IP [string trim [regsub -all {[,; ]+} $HDR " "]] {
                if {[catch {set MATCH [class match $IP equals DG-ALLOWED-IP-XFF]}] != 0} {
                    log local0.err "[virtual name]: Client [IP::client_addr] \
                    had an invalid X-Forwarded-For address - \x22${IP}\x22"
                    set MATCH 0
                }
                if {$MATCH} { break }
            }
        }
        if {!$MATCH} { HTTP::respond 403 Connection close }
        unset MATCH
    }
}

Notes

1. This rule checks your URI once. The example/objective you provided seems to be performing more than one match so it may need to be modified.
2. The outside/first

   foreach

   loop cycles each XFF header individually. Usually there is only 1, but it is possible for multiple headers to exist.
3. The inside/second

   foreach

   loop uses

   regsub

   +

   string trim

   to strip any seperator characters resulting in a valid TCL list.
4. When matching the address with

   class match

   , the

   catch

   command is used to prevent a TCL error and a log message created for later review.
5. Instead of

   reject

   , the rule is responding with a 403 Forbidden. The

   reject

   command works too, but my preference is a 403 response which is effectively the HTTP version of reject.
6. The logic in this rule can also match the real source IP and won't cycle X-Forwarded-For values if it matches. This may or may not be what you need. If not, the rule would need a

   set MATCH 0

   in its place.