Forum Discussion

Darren_Person_2's avatar
Darren_Person_2
Icon for Nimbostratus rankNimbostratus
May 07, 2007

Image Leeching / Random querystring fix?

Hi All,

 

 

We have the RAMCACHE module installed and are seeing a high rate of evictions. After some further investigation, it appears that we have someone linking to our images using a random querystring (i.e.: http://site.com/img/image.jpg?random=XXXXXX

 

 

This is generating many copies of this image in our cache. Can someone explain a possible iRule solution to strip off the querystring an make it so that they can no longer do this?

 

 

In addition, do you know of any iRule which would stop someone from leeching our images. i.e.: If the image isn't being requested from one of our domains in the browser url, then send back a fake image?

 

 

Any help you could provide would be greatly appreciated!!

 

12 Replies

  • Hi All,

     

     

    Just wanted to thank you for all your help! It turned out that we were on an older version and did the upgrade - here is the final code which we are now running:

     

     

    when HTTP_REQUEST {

     

    set filePath [string tolower [HTTP::path]]

     

    if { ($filePath ends_with ".jpg") or ($filePath ends_with ".swf")}{

     

    CACHE::uri [HTTP::host][HTTP::path]

     

    }

     

    }

     

     

    There should probably be a bunch of files in this list (*.jpg, *.gif, *.pdf, *.swf, *.xml, etc). If anyone can think of a cleaner way to implement this then using "or", I'd be interested (please keep in mind any performance hits associated with using match or switch satements).

     

     

    Thanks again!!

     

  • There are several ways you can cleanly add multiple extensions to compare against.

    1. Use a switch statement with file globbing (much more optimal than regular expressions.

    when HTTP_REQUEST {
      switch -glob [string tolower [HTTP::path]] {
        "*.jpg" -
        "*.gif" -
        "*.swf" -
        "*.pdf" -
        "*.xml" {
          CACHE::uri [HTTP::host][HTTP::path]
        }
      }
    }

    I'm not sure how this performs compared to an equivalent set of chained "or" expressions using the ends_with operator. It's most likely fairly equal so I'd go with the approach that is easier to read to you.

    2. using a data group (aka class) to contain the extensions and then using the matchclass command to search that list. Only go this route if you need to externalize your list and/or the items in your list number more than 100. It's been calculated that for items under 100 a switch with globbing is a little faster than a matchclass.

    bigip.conf rendering on the class

    class cache_extensions {

    .jpg

    .gif

    .pdf

    .swf

    .xml

    }

    when HTTP_REQUEST {
      if { [matchclass [string tolower [HTTP::path]] ends_with $::cache_extensions] } { 
         CACHE::uri [HTTP::host][HTTP::path]
     }
    }

    We've got a topic in the wiki that goes over some general rules of thumb for writing fast iRules.

    http://devcentral.f5.com/wiki/default.aspx/iRules/HowToWriteFastRules.html

    Click here

    Good luck and let us know if you find anything interesting during your implementation.

    -Joe