Forum Discussion

MW1's avatar
MW1
Icon for Cirrus rankCirrus
Apr 29, 2013

Can someone advise if this format of external class file (old v9.3.1) for addresses is in the correct formatt

Hi,

 

I have an irule that I have mashed together that checks the clients IP against a list in a file held locally on the F5 which works when I use an internal data group but is failing when I use an external one. It is on a very old 9.3.1 ltm. The F5 did not complain when I set it up however the matching does not appear to be working:

 

 

config b class IPlist list

 

 

class IPlist extern {

 

type ip

 

filename "/var/class/IPlist"

 

}

 

 

config cat /var/class/IPlist

 

 

host 172.30.0.30,

 

host 192.16.83.5,

 

host 128.44.5.3,

 

host 94.11.71.11,

 

host 128.33.4.3,

 

 

 

The Irule is

 

 

when HTTP_REQUEST {

 

log local0. "TEST-irule request coming"

 

switch -glob [string tolower [HTTP::uri]] {

 

"/medq_esb/proxy_services*" {

 

 

Only check POST requests

 

if { [HTTP::method] eq "POST" } {

 

log local0. "TEST-irule post request"

 

Default amount of request payload to collect (in bytes)

 

set collect_length 2048

 

 

Check for a non-existent Content-Length header

 

if {[HTTP::header Content-Length] eq ""}{

 

 

Use default collect length of 2k for POSTs without a Content-Length header

 

set collect_length $collect_length

 

 

} elseif {[HTTP::header Content-Length] == 0}{

 

 

Don't try collect a payload if there isn't one

 

unset collect_length

 

log local0. "TEST-irule no content length"

 

} elseif {[HTTP::header Content-Length] > $collect_length}{

 

 

Use default collect length

 

set collect_length $collect_length

 

 

} else {

 

 

Collect the actual payload length

 

set collect_length [HTTP::header Content-Length]

 

 

}

 

 

If the POST Content-Length isn't 0, collect (a portion of) the payload

 

if {[info exists collect_length]}{

 

 

Trigger collection of the request payload

 

HTTP::collect $collect_length

 

log local0. "TEST-irule going to collect request"

 

}

 

} else

 

{ pool company7_osb_pool } }

 

"/platform-webservices/filetransferdatatransferservices*" { pool company7_filetransfer_pool }

 

"/webservices/company*" { pool QASAR }

 

"/urls/forgot-password"

 

{ HTTP::redirect "https://ca.company.com/utilities/psa.aspx?ACT=REQPASS" }

 

"/urls/forgot-username"

 

{ HTTP::redirect "https://ca.company.com/utilities/psa.aspx?ACT=REQUNAME" }

 

default

 

{ discard

 

log local0. "TEST-irule request discarded" }

 

 

}

 

}

 

when HTTP_REQUEST_DATA {

 

 

set data {

 

Your IP address has not been recognized.

 

 

Please contact company support.false

 

}

 

 

 

Match the data for specific companyid and is a login request

 

if { [HTTP::payload] contains ">123" and [HTTP::payload] contains " log local0. "TEST-irule matched company and login request"

 

Match the clients IP to register list and respond with block MSG if not found

 

if { ![matchclass [IP::client_addr] equals $::IPlist] } {

 

log local0. "TEST-irule going to reply with block to [IP::client_addr] "

 

HTTP::respond 200 content $data "Content-Type" "text/xml; charset=utf-8"

 

}

 

else { pool company7_osb_pool

 

log local0. "TEST-irule IP Matched"

 

}

 

}

 

pool company7_osb_pool

 

log local0. "TEST-irule no company and login request match"

 

 

}

 

5 Replies

  • this is mine.

    [root@bigip:Active] config  b version|grep -iA 1 version
    BIG-IP Version 9.3.1 37.1
    Final Edition
    
    [root@bigip:Active] config  b rule myrule list
    rule myrule {
       when HTTP_REQUEST {
       log local0. "\[IP::client_addr\] [IP::client_addr]"
       log local0. "\[matchclass [IP::client_addr] equals $::IPlist\] [matchclass [IP::client_addr] equals $::IPlist]"
    }
    }
    [root@bigip:Active] config  b class IPlist list
    class IPlist extern {
       type ip
       filename "/var/class/IPlist"
    }
    [root@bigip:Active] config  cat /var/class/IPlist
    host 94.11.71.11,
    host 100.100.100.1,
    host 128.33.4.3,
    host 128.44.5.3,
    host 172.30.0.30,
    host 192.16.83.5,
    
    [root@bigip:Active] config  tail -f /var/log/ltm
    Apr 29 18:05:02 tmm tmm[1229]: Rule myrule : [IP::client_addr] 100.100.100.1
    Apr 29 18:05:02 tmm tmm[1229]: Rule myrule : [matchclass 100.100.100.1 equals {172.30.0.30/32} {192.16.83.5/32} {128.44.5.3/32} {94.11.71.11/32} {128.33.4.3/32} {100.100.100.1/32}] 6
    Apr 29 18:05:04 tmm tmm[1229]: Rule myrule : [IP::client_addr] 100.100.100.3
    Apr 29 18:05:04 tmm tmm[1229]: Rule myrule : [matchclass 100.100.100.3 equals {172.30.0.30/32} {192.16.83.5/32} {128.44.5.3/32} {94.11.71.11/32} {128.33.4.3/32} {100.100.100.1/32}] 0
    
    
  • Thanks for the response - I have realised my issue is the external data group does not get reloaded when the file was altered so it is matching, just not using the updated data. The F5 this is eventually destined for is running v11 so that might give me some options round this (I only have the v9.3.1 to test on currently and realise there will need to be a few tweaks to the irule for v11). Unfortunately I am looking to have this data group updated without needing support accessing the F5, so need to look for someway to detect the file has changed and perform an action to read the new data group.

     
    when HTTP_REQUEST {
    log local0. "TEST-irule request coming"
        switch -glob [string tolower [HTTP::uri]] {
            "/medq_esb/proxy_services*" {
    
      Only check POST requests
       if { [HTTP::method] eq "POST" } {
    log local0. "TEST-irule post request"
           Default amount of request payload to collect (in bytes)
          set collect_length 2048
    
           Check for a non-existent Content-Length header
          if {[HTTP::header Content-Length] eq ""}{
    
              Use default collect length of 2k for POSTs without a Content-Length header
             set collect_length $collect_length
    
          } elseif {[HTTP::header Content-Length] == 0}{
    
              Don't try collect a payload if there isn't one
             unset collect_length
             log local0. "TEST-irule no content length"
          } elseif {[HTTP::header Content-Length] > $collect_length}{
    
              Use default collect length
             set collect_length $collect_length
    
          } else {
    
              Collect the actual payload length
             set collect_length [HTTP::header Content-Length]
    
          }
    
           If the POST Content-Length isn't 0, collect (a portion of) the payload
          if {[info exists collect_length]}{
    
              Trigger collection of the request payload
             HTTP::collect $collect_length
    log local0. "TEST-irule going to collect request"
          }
    } else
     { pool company7_osb_pool } } 
            "/platform-webservices/filetransferdatatransferservices*" { pool company7_filetransfer_pool }
      "/webservices/company*" { pool QASAR }
         "/urls/forgot-password"   
                 { HTTP::redirect "https://ca.company.com/utilities/psa.aspx?ACT=REQPASS" }
            "/urls/forgot-username"   
                 { HTTP::redirect "https://ca.company.com/utilities/psa.aspx?ACT=REQUNAME" }
        default
            { discard   
    log local0. "TEST-irule request discarded" }
     
        }
    }
    when HTTP_REQUEST_DATA {
     
    set data {
    Your IP address has not been recognized.  
    
    Please contact company support.false
    }
    
    
     Match the data for specific companyid and is a login request
       if {  [HTTP::payload] contains ">123" and    [HTTP::payload] contains "
  • Realise I am starting to fall out of the irule arena, however to prevent starting multiple threads - looking in to loading a data group it appears I need to issue a b load to reload the config. Can anyone advise if existing connections are disrupted/lost during a config load?

    To complete the picture I am running an external monitor script to poll and update the data group from a remote web site (guess could as easily be done by cron - however thanks to the gent who suggested)

     
    !/bin/bash
     F5 monitor script to pull IP list for data group from remote web page
    
    
    define tmp file with path for download
    tmpfile="/var/tmp/ip-tmp"
    
    define final IPlist data group file with path used by F5
    IPlist="/var/class/IPlist"
    
    define URL to retrive IP's from e.g http://site/list.html
    URL="http://192.168.52.243/IPlist.html"
    
    
    PIDFILE="/var/run/`basename ${0}`.pid"
    
     kill of the last instance of this monitor if hung and log current pid
    if [ -f $PIDFILE ]
    then
       kill -9 `cat $PIDFILE` > /dev/null 2>&1
    fi
    echo "$$" > $PIDFILE
    
    
     Call curl to download IP list and pull IP's using perl with correct formatting and write to tmp file
    curl -s $URL | perl -lne 'while (/(\d+\.){3}\d+/g){print "host $&,"}' > $tmpfile
    
     Check tmp is not empty
    if [ -s "$tmpfile" ]
    then
    
    check if the files differ
    diff $tmpfile $IPlist
    
    if [ $? -ne 0 ]
    then
     copy the tmp file over the original file
    
    cp -fr $tmpfile $IPlist
    
     reload config to pick up new data group
    b load
    
    fi
    fi
    
    rm -f $tmpfile
    rm -f $PIDFILE
    
    exit
    
  • Can anyone advise if existing connections are disrupted/lost during a config load? yes

     

     

    instead of re-loading configuration, can you try something like this?

     

     

    How do you re-instantiate an iRule after external Data Group changes?

     

    https://devcentral.f5.com/community/group/aft/2165353/asg/50

     

     

    by the way, you know external file is managed differently in 11.x, don't you?

     

     

    sol13423: Importing external files to the BIG-IP system

     

    http://support.f5.com/kb/en-us/solutions/public/13000/400/sol13423.html
  • Thanks for that - I was actually in mid-reply when you posted stating I had updated to similar to the above -I was actually deleting then re-adding however your suggestion of just adding is even less impacting.

     

     

    Very much appreciated