Coding Live: Policies & iRules - Dec 8, 2022

No way... i will be the random dude in the chat asking silly questions. 😂

Cheers, Kai 

Hi Jason,

for the [switch] it does basically dont matter if multiple condition trigger the same script or different scripts. The overhead from evaluating 50 strings is the same... 

Single Script:

when HTTP_REQUEST {
	lappend time(iRule_50rules_single_scripts) [clock clicks]
	switch -exact -- [HTTP::host] {
		"www.domain-01.de" -
		"www.domain-02.de" -
		... truncated ...
		"www.domain-48.de" -
		"www.domain-49.de" -
		"www.domain-50.de" { pool www.itacs.de }
		default { pool REST_API }
	}
	lappend time(iRule_50rules_single_scripts) [clock clicks]
	eval $static::debug_page
}

Many individual Scripts:

when HTTP_REQUEST {
	lappend time(iRule_50rules_single_scripts) [clock clicks]
	switch -exact -- [HTTP::host] {
		"www.domain-01.de" { pool www.itacs.de }
		"www.domain-02.de" { pool www.itacs.de }
		... truncated ...	
		"www.domain-50.de" { pool www.itacs.de }
		"www.domain-50.de" { pool www.itacs.de }
		default { pool REST_API }
	}
	lappend time(iRule_50rules_single_scripts) [clock clicks]
	eval $static::debug_page
}

But it does matter if you trigger [switch]'s first (see below) or default (see above) conditions....

1st hit:

25th hit:

50th hit:

Old facts remaining the same. The more item in the list and the deeper your have to dig into the list the longer it takes to evaluate it.  

Lets see if we can find some better replacements for [switch]...

Using [if]:

when HTTP_REQUEST {
	lappend time(iRule_5if_1st_hit) [clock clicks]
	if { [HTTP::host] eq "www.domain-01.de" } then { pool www.itacs.de }
	elseif { [HTTP::host] eq "www.domain-02.de" } then { pool www.itacs.de }
	elseif { [HTTP::host] eq "www.domain-03.de" } then { pool www.itacs.de }
	elseif { [HTTP::host] eq "www.domain-04.de" } then { pool www.itacs.de }
	elseif { [HTTP::host] eq "www.domain-05.de" } then { pool www.itacs.de }
	else { pool REST_API }
	lappend time(iRule_5if_1st_hit) [clock clicks]
	eval $static::debug_page
}

1st hit [if] is slightly quicker than [switch}, 5th hit [if] is about the same as [switch]. Nothing new about...

[eval] loading a script from static::array()  with 1.000.000 bucket entries

when RULE_INIT {
	for { set x 1 } { $x < 1000000 } { incr x } {
		set my_conditional_scripts(www.domain-${x}.de) { pool www.itacs.de }
	}
}
when HTTP_REQUEST {
	lappend time(iRule_eval_1million_bucket) [clock clicks]
	if { [catch {
		eval $my_conditional_scripts([HTTP::host])
	}] } then {
		 pool REST_API
	}
	lappend time(iRule_eval_1million_bucket) [clock clicks]
	eval $static::debug_page
}

Performance in the range of a 50-entry [switch] statemen, not bad. Can LTP handle 1M URLs? And how fast?  

Will do some additional LTP tests in the evening. Lets see where LTP limits are...

Cheers, Kai 

in LTP a header-replace has same problems as [HTTP::header replace] in iRule. If user-agent sends 2 header instances, only one instance gets replaced in the request. For a X-Forwarded-For protection this is obviously not the right way to do it... 

Cheers, Kai