data group not matching

Question

I'm writing an irule to deny logins from external users. I've tried to define a datagroup that contains allowed subnets, but have not been able to get it to match to an incoming address. See below.&nbsp;

&nbsp;
&nbsp;

class UserDataGroup {&nbsp;
   {&nbsp;
      network 10.9.0.0/13&nbsp;
      network 10.16.0.0/13&nbsp;
   }&nbsp;
}&nbsp;

&nbsp;
&nbsp;
&nbsp;

&nbsp;
&nbsp;
when CLIENT_ACCEPTED {&nbsp;
   set debug "1"&nbsp;
   if {$debug} {log local0. "Client IP address is: [IP::remote_addr]"}&nbsp;
      Check if client IP is not in the UserDataGroup&nbsp;
     if { [matchclass [IP::remote_addr] equals $::UserDataGroup] }{&nbsp;
       log local0. "Client is in UserDataGroup1"&nbsp;
        Prevent the HTTP_REQUEST event from firing if user is from local network&nbsp;
       event HTTP_REQUEST disable&nbsp;
     }&nbsp;
     else {log local0. "Client is in NOT UserDataGroup"}&nbsp;
}&nbsp;

&nbsp;
&nbsp;
when HTTP_REQUEST {&nbsp;
  switch -glob [HTTP::uri] {&nbsp;
    "/login.aspx" -&nbsp;
    "/foo/login.aspx" -&nbsp;
    "/bar/login.aspx" {&nbsp;
       Reject login info from non local sites&nbsp;
      HTTP::respond 403 content "Logins only allowed from local networks.
"&nbsp;
    }&nbsp;
  }&nbsp;
}&nbsp;

&nbsp;
&nbsp;
&nbsp;

&nbsp;
&nbsp;
Apr  1 14:12:52 local/tmm info tmm[4711]: Rule LocalOnly : Client IP address is: 10.10.17.153&nbsp;
Apr  1 14:12:52 local/tmm info tmm[4711]: Rule LocalOnly : Client is in NOT UserDataGroup&nbsp;
&nbsp;

&nbsp;
&nbsp;

&nbsp;
&nbsp;
If I change my rule to this it works fine&nbsp;

&nbsp;

if { [IP::addr [IP::remote_addr] equals 10.9.0.0/12] }{&nbsp;

log local0. "Client is in UserDataGroup1"&nbsp;

&nbsp;
&nbsp;
       Prevent the HTTP_REQUEST event from firing if user is from local network&nbsp;
      event HTTP_REQUEST disable&nbsp;
   }&nbsp;
   elseif { [IP::addr [IP::remote_addr] equals 10.16.0.0/13] }{&nbsp;

log local0. "Client is in UserDataGroup2"&nbsp;
&nbsp;

&nbsp;

&nbsp;
&nbsp;
Any idea what I'm doing wrong?&nbsp;

coreyva · Answer

Oops, bad CIDR. It should have been. It works now. 
&nbsp;  
&nbsp; class UserDataGroup { 
&nbsp;    { 
&nbsp;       network 10.8.0.0/13 
&nbsp;       network 10.16.0.0/13 
&nbsp;    } 
&nbsp; }

hooleylist · Answer

Which LTM version are you running?  For 9.4.4+ you should remove the $:: prefix from the datagroup name references in the iRule.  If you're on v10, you could also change matchclass to 'class match' to improve the efficiency of the iRule: 
&nbsp;  
&nbsp; http://devcentral.f5.com/wiki/default.aspx/iRules/class 
&nbsp;  
&nbsp; Also, if you're using IIS, you should set the URI to lowercase in the switch statement.  You could also check HTTP::path instead of HTTP::uri.  This would catch someone using a URI like /login.aspx? or /login.aspx?ignore=this to bypass your logic. 
&nbsp;  
&nbsp;   switch -glob [string tolower [HTTP::path]] { 
&nbsp;  
&nbsp; Aaron

coreyva · Answer

Thanks. I did note the change to "class match" shortly after my initial post. I appreciate the you mentioning HTTP::path. I'll implement it as well as the lowercase.

coreyva · Answer

Here is what I ended up with. 
&nbsp;  
&nbsp; when CLIENT_ACCEPTED { 
&nbsp;    set DEBUG "0" 
&nbsp;    if { $DEBUG } {log local0. "Client IP address is: [IP::remote_addr]"} 
&nbsp;       Check if client IP is not in the UserDataGroup 
&nbsp;      if { [class match [IP::remote_addr] equals "UserDataGroup"] }{ 
&nbsp;        if { $DEBUG } {log local0. "Client is in UserDataGroup"} 
&nbsp;         Prevent the HTTP_REQUEST event from firing if user is local 
&nbsp;        event HTTP_REQUEST disable 
&nbsp;      } 
&nbsp;      elseif { $DEBUG } {log local0. "Client is in NOT UserDataGroup"} 
&nbsp; } 
&nbsp;  
&nbsp; when HTTP_REQUEST { 
&nbsp; switch -glob [string tolower HTTP::path] { 
&nbsp;         "/login.aspx" - 
&nbsp;         "/foo/login.aspx" - 
&nbsp;         "/bar/login.aspx" { 
&nbsp;  Reject login info from non  sites 
&nbsp; HTTP::respond 403 content "Logins only allowed from  networks.
" 
&nbsp; } 
&nbsp; } 
&nbsp; }

hooleylist · Answer

That looks good.  One small correction: you're missing the square braces around HTTP::path: 
&nbsp;  
&nbsp; switch -glob [string tolower [HTTP::path]] {  
&nbsp;  
&nbsp; Also be aware that it's really simple to bypass URI based checks like that on IIS: 
&nbsp;  
&nbsp; http://devcentral.f5.com/Community/GroupDetails/tabid/1082223/asg/50/aft/30900/showtab/groupforums/Default.aspx31324 
&nbsp;  
&nbsp; Aaron

Forum Discussion

data group not matching

6 Replies

Recent Discussions

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

F5 Access Guard Deprecated: ZTA APM

F5 loadbalancer not working

Pricing when used with aws waf

F5 terminal - help to run commands - disk space full

Related Content

Mass input/create "Data group list" ?

Class match with starts_with - Data group matching order

Certified Kubernetes Administrator - Study Group

iRules Data Group Formatting Rules

Re: Automate Data Group updates on many Big-IP devices using Big-IQ or Ansible