For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Sylvain_Maitena's avatar
Sylvain_Maitena
Icon for Nimbostratus rankNimbostratus
Jul 18, 2016

capture IP client on IMAP request

I used this I-Rule to insert the client IP in the Http Header of the request to gather this information on my server : " when HTTP_REQUEST { HTTP::header insert X-Forwarded-For [IP::client_addr] } " ...
application delivery
iRules
lubrano_frederi's avatar
lubrano_frederi
Icon for Nimbostratus rankNimbostratus
Oct 24, 2016

Hi,

 

It is possible log ip address for Zimbra proxy IMAP :

 

Mac:~ fred$ telnet 10.50.3.154 143 Trying 10.50.3.154... Connected to 10.50.3.154. Escape character is '^]'. * OK IMAP4 ready A ID ("X-ORIGINATING-IP" "172.31.0.70") * ID ("NAME" "Zimbra" "VERSION" "8.6.0_GA_1153" "RELEASE" "20141215151116") A OK completed B login fred@mail.blabla.local blabla B OK [CAPABILITY IMAP4rev1 ACL BINARY CATENATE CHILDREN CONDSTORE ENABLE ESEARCH ESORT I18NLEVEL=1 ID IDLE LIST-EXTENDED LIST-STATUS LITERAL+ LOGIN-REFERRALS MULTIAPPEND NAMESPACE QRESYNC QUOTA RIGHTS=ektx SASL-IR SEARCHRES SORT THREAD=ORDEREDSUBJECT UIDPLUS UNSELECT WITHIN XLIST] LOGIN completed C select INBOX * 3 EXISTS * 0 RECENT * OK [UIDVALIDITY 1] UIDs are valid for this mailbox * OK [UIDNEXT 281] next expected UID is 281 * FLAGS (\Answered \Deleted \Draft \Flagged \Seen $Forwarded $MDNSent Forwarded $Junk $NotJunk Junk JunkRecorded NonJunk NotJunk) * OK [PERMANENTFLAGS (\Answered \Deleted \Draft \Flagged \Seen $Forwarded $MDNSent Forwarded *)] junk-related flags are not permanent * OK [HIGHESTMODSEQ 660] modseq tracked on this mailbox C OK [READ-WRITE] SELECT completed D logout * BYE mail.msc.local Zimbra IMAP4rev1 server closing connection D OK LOGOUT completed Connection closed by foreign host.

 

by cons I do not know how to irule ????

 

when CLIENT_ACCEPTED { set client_addr [ip::client_ad TCP::collect }

 

when SERVER_CONNECTED {

 

TCP::collect }

 

when SERVER_DATA { if { [TCP::payload] contains "* A ID" } { TCP::payload replace "* A /[X-ORIGINATING-IP/]" + $client_addr TCP::release clientside { TCP::collect }

 

} else { TCP::release TCP::collect } }

 

Thanks for the help

 

fred