Forum Discussion

Andrés_Ortiz_10's avatar
Andrés_Ortiz_10
Icon for Nimbostratus rankNimbostratus
Aug 11, 2007

<b> ldapsearch error </b>

Hi, we try Load Balance with i-rules and class networks,and we have problems with this.The request that we send is:

 

 

 

ldapsearch -h 10.237.0.255 -b o=SIUX "LOGIN-IP=10.146.248.2" MSISDN

 

 

 

Everything go ok, the ip match with LDAP_Group, until we send a Filter (“LOGIN-IP”) more big that 13 caracters or with not IP format (x.x.x.x).

 

 

When we send 14 caracters or more, (example: 10.146.248.200) the irule shows the next message error:

 

 

Jun 27 11:42:36 tmm tmm]: 01220002:6: Rule LDAP_IRULE : IP Capturada: 10.146.248.200

 

Jun 27 11:42:36 tmm tmm]: 01220001:3: TCL error: Rule LDAP_IRULE - missing "mask"Invalid class element 10.146.248.20 for class LDAP_GroupA invoked from within "matchclass $LoginIP equals $::LDAP_GroupA"

 

 

 

I don’t know how this error because I do the match always with and address with a correct format:

 

 

set IP [concat “Octeto_Uno.$Octeto_Dos.$Octeto_Tres.1”]

 

 

 

any idea for this problem?

 

 

thanks in advantage

 

 

...................................

 

 

class LDAP_GroupA {

 

"network 10.16.13.0/26"

 

 

}

 

 

class myPoolB{

 

"network 10.16.13.64/26"

 

 

}

 

 

...................................

 

 

when RULE_INIT {

 

set ::defaultPool myPool

 

}

 

when CLIENT_ACCEPTED {

 

TCP::collect

 

}

 

 

when CLIENT_DATA {

 

 

set LoginIP [findstr [TCP::payload] LOGIN-IP 9 "MSISDN"]

 

 

set Octeto_Uno [getfield $LoginIP “.” 1 ]

 

set Octeto_Dos [getfield $LoginIP “.” 2 ]

 

set Octeto_Tres [getfield $LoginIP “.” 3 ]

 

 

set IP [concat “Octeto_Uno.$Octeto_Dos.$Octeto_Tres.1”]

 

 

if {$IP != ""}{

 

if { [matchclass $LoginIP equals $::LDAP_GroupA]}{

 

pool PoolA

 

} elseif { [matchclass $LoginIP equals $::LDAP_GroupB]}{

 

pool PoolA

 

}

 

} else {

 

pool $::defaultPool

 

}

 

TCP::release

 

}

 

  • spark_86682's avatar
    spark_86682
    Historic F5 Account
    I think that you're just using the wrong variable. You have:

    
    set IP [concat “Octeto_Uno.$Octeto_Dos.$Octeto_Tres.1”]
    if {$IP != ""}{
    if { [matchclass $LoginIP equals $::LDAP_GroupA]}{
    pool PoolA
    } elseif { [matchclass $LoginIP equals $::LDAP_GroupB]}{
    pool PoolA
    }
    } else {
    pool $::defaultPool
    }
    TCP::release
    }

    You're constructing the ip address in the "IP" variable, but then you're using the original "LoginIP" variable in the matchclass statements.

    Also, if you're concerned that you might get input that isn't an IP address, you should do some data validation to make sure that the "Octeto" variables actually contain numbers.