Forum Discussion

Levin_Chen_1516's avatar
Levin_Chen_1516
Icon for Nimbostratus rankNimbostratus
Dec 26, 2008

X-Forwarded-For problem?

Hi

I have a iRules as follow: 

    
    when HTTP_REQUEST {    
      if { [HTTP::header exists "X-Forwarded-For"] } {    
        set xForwardedNum [HTTP::header count "X-Forwarded-For"]    
        log local0. "Removing - X-Forwarded-For: $xForwardedNum"    
        if { $xForwardedNum > 0 } {    
          if attack X-ForwardNum greater than 0, remove and reinsert X-Forwarded-For.    
          log local0. "Removing and Reinsert - X-Forwarded-For."    
          HTTP::header remove "X-Forwarded-For"    
          HTTP::header insert "X-Forwarded-For" [IP::client_addr]    
        }    
      }    
    }

Then I had did enable "Insert XForwarded For" in http profile. I can get log as follow: 

Dec 26 11:06:22 tmm tmm[1143]: Rule iRules_secret_snat : Removing - X-Forwarded-For: 0

However, I have do insert "X-Forwarded-For" by "Request Builder"(A tool can add header in client request). Then I can get log as follow: 

Dec 26 11:06:08 tmm tmm[1143]: Rule iRules_secret_snat : Removing - X-Forwarded-For: 2

Why [HTTP::header count "X-Forwarded-For"] is zero when enable "Insert XForwarded For" in http profile?

Then I modified iRules as follow: 

 
 when HTTP_REQUEST { 
   HTTP::header insert "X-Forwarded-For" [IP::client_addr] 
   if { [HTTP::header exists "X-Forwarded-For"] } { 
     set xForwardedNum [HTTP::header count "X-Forwarded-For"] 
     set xForwardedValue [HTTP::header value "X-Forwarded-For"] 
     log local0. "Removing - X-Forwarded-For: $xForwardedNum $xForwardedValue." 
     if { $xForwardedNum > 0 } { 
       if attack X-ForwardNum greater than 0, remove and reinsert X-Forwarded-For. 
       log local0. "Removing and Reinsert - X-Forwarded-For." 
       HTTP::header remove "X-Forwarded-For" 
       HTTP::header insert "X-Forwarded-For" [IP::client_addr] 
     } 
   } 
 }

I can get log as follow: 

Dec 26 11:36:57 tmm tmm[1143]: Rule iRules_secret_snat : Removing - X-Forwarded-For: 0 10.10.100.13.
application delivery
dev
devops
iRules

2 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Dec 29, 2008
    Oddly enough, HTTP::header count "header-name" starts counting at 0. So you can't tell just from using HTTP::header count "X-Forwarded-For" whether there is no header or one header. I'd call this a bug. If you'd like F5 to address this, you could open a case with F5 Support.

     

     

    A simple workaround would be to set the HTTP profile to remove the X-Forwarded-For header in the 'Request Header Erase' field. You could then enable the 'Insert XForwarded For' option in the profile and avoid using an iRule altogether. The header to erase option is handled before the insert. So any existing XFF headers would be removed and then LTM would insert a new XFF header with the client IP address it received.

     

     

    Aaron
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jan 05, 2009
    F5 created CR114612 to track this bug where HTTP::header count returns one less than the actual number of headers. You can check with F5 Support or the release notes for status on this CR.

     

     

    Aaron