Forum Discussion
Andrés_Ortiz_10
Nimbostratus
Aug 11, 2007<b> ldapsearch error </b>
Hi, we try Load Balance with i-rules and class networks,and we have problems with this.The request that we send is:
ldapsearch -h 10.237.0.255 -b o=SIUX "LOGIN-IP=10.146.248.2" MSISDN
Everything go ok, the ip match with LDAP_Group, until we send a Filter (“LOGIN-IP”) more big that 13 caracters or with not IP format (x.x.x.x).
When we send 14 caracters or more, (example: 10.146.248.200) the irule shows the next message error:
Jun 27 11:42:36 tmm tmm]: 01220002:6: Rule LDAP_IRULE : IP Capturada: 10.146.248.200
Jun 27 11:42:36 tmm tmm]: 01220001:3: TCL error: Rule LDAP_IRULE - missing "mask"Invalid class element 10.146.248.20 for class LDAP_GroupA invoked from within "matchclass $LoginIP equals $::LDAP_GroupA"
I don’t know how this error because I do the match always with and address with a correct format:
set IP [concat “Octeto_Uno.$Octeto_Dos.$Octeto_Tres.1”]
any idea for this problem?
thanks in advantage
...................................
class LDAP_GroupA {
"network 10.16.13.0/26"
}
class myPoolB{
"network 10.16.13.64/26"
}
...................................
when RULE_INIT {
set ::defaultPool myPool
}
when CLIENT_ACCEPTED {
TCP::collect
}
when CLIENT_DATA {
set LoginIP [findstr [TCP::payload] LOGIN-IP 9 "MSISDN"]
set Octeto_Uno [getfield $LoginIP “.” 1 ]
set Octeto_Dos [getfield $LoginIP “.” 2 ]
set Octeto_Tres [getfield $LoginIP “.” 3 ]
set IP [concat “Octeto_Uno.$Octeto_Dos.$Octeto_Tres.1”]
if {$IP != ""}{
if { [matchclass $LoginIP equals $::LDAP_GroupA]}{
pool PoolA
} elseif { [matchclass $LoginIP equals $::LDAP_GroupB]}{
pool PoolA
}
} else {
pool $::defaultPool
}
TCP::release
}
1 Reply
- spark_86682Historic F5 AccountI think that you're just using the wrong variable. You have:
set IP [concat “Octeto_Uno.$Octeto_Dos.$Octeto_Tres.1”] if {$IP != ""}{ if { [matchclass $LoginIP equals $::LDAP_GroupA]}{ pool PoolA } elseif { [matchclass $LoginIP equals $::LDAP_GroupB]}{ pool PoolA } } else { pool $::defaultPool } TCP::release }
You're constructing the ip address in the "IP" variable, but then you're using the original "LoginIP" variable in the matchclass statements.
Also, if you're concerned that you might get input that isn't an IP address, you should do some data validation to make sure that the "Octeto" variables actually contain numbers.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects