For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

John_Cassidy_13's avatar
John_Cassidy_13
Icon for Nimbostratus rankNimbostratus
Feb 21, 2014

IP and HTTP Events iRule

We have a new web app that we want to lock down to not only source IP address but also the web URI. Each customer has a different interface on the web app so we want to send requests to a different pool based on URI. However, we do not want customer A gaining access to customer B's site, thus the source IP address lookup.

Below is what I tried to do on a first attempt. Is there a way to do this when the client connects and not every HTTP request?

when HTTP_REQUEST {  
    if { [matchclass $::CustA_Source_IPs contains [IP::client_addr]] and [HTTP::uri] eq "/custa"  } {  
        pool CustomerA_Pool
    }
    elseif { [matchclass $::CustB_Source_IPs contains [IP::client_addr]] and [HTTP::uri] eq "/custb"  } {  
        pool CustomerB_Pool
    }   
    else {  
        drop  
    }  
}
application delivery
design
devops
iRules
LTM
performance
security

3 Replies

  • Richard__Harlan's avatar
    Richard__Harlan
    Historic F5 Account
    Feb 21, 2014

    What I would look at doing is in the CLIENT_CONNECTED event have a data group with IP:clientID. When the IP is looked up the value returned is the clientID. Then in the HTTP_REQUEST you can turn the clientID that was returned in the CLIENT_CONNECTED to be the datagroup name for all the URI the client can connect to.

     

    This will still require one look up per HTTP Request but it would cut down the IP lookup and make the iRule easier to maintain as all you would need to do is create one Data group per customer with the sane name as the clientID in the IP lookup. Just a thought.

     

  • Matt_Breedlove_'s avatar
    Matt_Breedlove_
    Icon for Nimbostratus rankNimbostratus
    May 19, 2014

    I did this awhile ago. Here is the best way to do this Your prefix URI's below are /xl and /ce. The source IP list that secure each customers prefix URI's go into the acl datagroup objects as address type

    
when HTTP_REQUEST {
   switch -glob [URI::decode [string tolower [HTTP::uri]]] {
      /xl* { if { ([class match [IP::remote_addr] equals $::xl_acl]) } { return } }
      /ce* { if { ([class match [IP::remote_addr] equals $::ce_acl]) } { return } } 

      default {
         discard
      }
   }
}