iRule for Server Testing

Question

Good morning,&nbsp;
&nbsp;Please see attached doc.&nbsp;
&nbsp;Essentially, what we are trying to achieve is to be able to validate that a single server behind a VS is responding correctly. Ideally, we could rewrite both the request and the response to make the client "think" that it is receiving content from the URL to which they connected, when in fact it has been cloaked to the server and back to the client via header rewrite.&nbsp;
&nbsp;I'm assuming this must be possible, but have not seen this done before. Perhaps there are some other alternatives on how this could be done differently?&nbsp;
&nbsp;I could not attach the word document ("Invalid file type or exceeds max size(60kb)" even though the file is 28k) but here is the guts of the content:&nbsp;
&nbsp;RE: BIG-IP 1500
&nbsp;SN: bip071410s / bip071401s
&nbsp;Version: 9.0.5&nbsp;
&nbsp;Environment:&nbsp;
&nbsp;- 4 web servers: web001, web002, web003, web004
&nbsp;- front-ended by single VS on BIG-IP&nbsp;
&nbsp;Requirements:&nbsp;
&nbsp;1) Each web server runs multiple sites via HTTP/1.1 host headers:&nbsp;
&nbsp;companyA.pnimedia.com
&nbsp;companyB.pnimedia.com
&nbsp;companyC.pnimedia.com&nbsp;
&nbsp;2) Sites are accessed via virtual server on BIG-IP from front end and back end (via VPN)&nbsp;
&nbsp;3) We would like to be able to test (connect and verify) each web server independently, ideally through iRules processing.&nbsp;
&nbsp;Desired functionality:&nbsp;
&nbsp;http://companyA.test.pnimedia.com/web001
&nbsp;- use node web001 AND rewrite request/response to companyA.pnimedia.com
&nbsp;http://companyB.test.pnimedia.com/web003
&nbsp;- use node web003 AND rewrite request/response to companyB.pnimedia.com&nbsp;
&nbsp;Ideally, if the above could be specified in some sort of matrix/which statements like this:&nbsp;
&nbsp;web001 = 10.10.10.101
&nbsp;web003 = 10.10.10.113 (etc.)&nbsp;
&nbsp;I appreciate any comments, recommendations and/or sample iRules!&nbsp;
&nbsp;Thanks,
&nbsp;Chris

joe_pruitt · Answer

Chris, I moved your post over to the iRules forum.  Next time, if you could post iRules questions over there that would help you get a better response.&nbsp;
&nbsp;Also, the forums weren't configured to allow uploads of .doc files.  I've modified that so you should be able to post your attachment (and I've bumped the size limit up to 100k).&nbsp;
&nbsp;Now, on to your question:&nbsp;
&nbsp;As for monitoring, iRules does not have the ability to test an application directly in the code.  You will have to rely on either external monitors (if your errors are detected via HTTP content or network connectivity).&nbsp;
&nbsp;As for having iRules do some manipulation of the request uri then that has been covered many times here on the forum.  Here's a sample on how you can build 2 classes, one for the host mapping and another for the node mapping.&nbsp;&nbsp;*** String data groups ***
class host_mapping {
  companyA.test.pnimedia.com companyA.pnimedia.com
  companyB.test.pnimedia.com companyB.pnimedia.com
  companyC.test.pnimedia.com companyC.pnimedia.com
}
class node_mapping {
  web001 10.10.10.1
  web002 10.10.10.2
  web003 10.10.10.3
}
*** Begin iRule *** 
when HTTP_REQUEST {
   Search for host mapping in the lookup list
  set new_host [findclass [HTTP::host] $::host_mapping " "]
  if { "" ne $new_host } {
     if mapping is found, replace the Host header
    log local0. "Replacing host from [HTTP::host] to $new_host"
    HTTP::header replace "Host" $new_host"
     Pull out the node name as the first element of the uri
     ie. /web001/foo/bar -&gt; web001
    set node_name [lindex [split [HTTP::uri] "/"] 1]
    if { "" ne $node_name } {
       Now look for the node address in the lookup list
      log local0. "Searching for node: $node_name"
      set node_addr [findclass $node_name $::node_mapping " "]
      if { "" ne $node_addr } {
        log local0. "Routing to node: $node_addr " 
        node $node_addr
      } else {
        log local0. "Didn't find node '$node_name' in lookup class"
      }
    } else {
      log local0. "No node name passed in URI"
    }
  } else {
    log local0. "Didn't find [HTTP::host] in lookup class"
  }
}&nbsp;
&nbsp;There may be more elegant ways to extract the node out of the uri without making a list.  I'll leave it to you to figure that optimization out.&nbsp;
&nbsp;Good luck!&nbsp;
&nbsp;-Joe

chris_day_10331 · Answer

Hey Joe,&nbsp;
&nbsp;Thanks a bunch! That is great! One problem I get trying to compile this rule under 9.0.5 is:&nbsp;
&nbsp;01070151:3: Rule [PNI_TestProcessor] error:
&nbsp;line 3: [undefined procedure: class] [class host_mapping {
&nbsp;companyA.test.pnimedia.com companyA.pnimedia.com
&nbsp;companyB.test.pnimedia.com companyB.pnimedia.com
&nbsp;companyC.test.pnimedia.com companyC.pnimedia.com
&nbsp;}]&nbsp;
&nbsp;Since I am relatively new to this, do you know if I am doing something wrong? I did not see any feature enhancements since 9.0.5 that seem to apply.&nbsp;
&nbsp;Also, if you have any whiz bang ideas on how to extract the node out of the URI I am all ears and will owe you a beer or 12.&nbsp;
&nbsp;Thanks,
&nbsp;Chris&nbsp;
&nbsp;FYI - I am an ex-F5 SE (worked with Vilnis) now working with a reseller (Pro-Data) up in Western Canada.

colin_walker_12 · Answer

Oh, and about the node name out of the URI, Joe's rule example does that already.
This section here is the part that performs the lookup:
...
    Pull out the node name as the first element of the uri
     ie. /web001/foo/bar -&gt; web001
    set node_name [lindex [split [HTTP::uri] "/"] 1]
    if { "" ne $node_name } {
       Now look for the node address in the lookup list
      log local0. "Searching for node: $node_name"
      set node_addr [findclass $node_name $::node_mapping " "]
      if { "" ne $node_addr } {
        log local0. "Routing to node: $node_addr " 
        node $node_addr
...
It does a lookup in this class to relate the "web001" or whatever the hostname is in the URI, to the actual IP of the node:
class node_mapping {
  web001 10.10.10.1
  web002 10.10.10.2
  web003 10.10.10.3
}
So, for a request with web001 in the URI, it will be forwarded to 10.10.10.1.
Hopefully that helps clarify a bit.
-Colin

chris_day_10331 · Answer

Hi Guys,
Thanks for replying - this is truly a big help. I now have a better understanding of how this all works and have been analyzing the results captured with tcpdump. Here is what I am seeing:
If I issue the following (via telnet):telnet blacks.test.pnimedia.com
GET / HTTP/1.1
HOST: blacks.pnimedia.com
Everything works fine and I get the expected content.
*However*, via the rule I have created according to your posts everything seems to be correct. Is it possible that the HTTP/1.1 header is not being included in the request down to the node? I am seeing this (as expected) in the 'ltm' logs:Rule PNI_TestProcessor : Replacing host from blacks.test.pnimedia.com to blacks.pnimedia.com
Rule PNI_TestProcessor : Searching for node: web002
Rule PNI_TestProcessor : Routing to node: 10.10.20.51 
Which is correct!
Tcpdumps, however, reveal a different story. The external dump captured was as follows:tcpdump -w /var/tmp/external.dump -ni external port 80 and host 64.85.47.204
The internal dump captured was as follows:tcpdump -w /var/tmp/internal.dump -ni internal port 80 and host 64.85.47.204
Both of these are attached, but as a summary it looks like request is malformed.
For reference, here is what is in the rule "PNI_TestProcessor" which I have attached to the VS in question:
when HTTP_REQUEST {
 Search for host mapping in the lookup list
set new_host [findclass [HTTP::host] $::host_mapping " "]
if { "" ne $new_host } {
 if mapping is found, replace the Host header
log local0. "Replacing host from [HTTP::host] to $new_host"
HTTP::header replace "Host" $new_host"
 Pull out the node name as the first element of the uri
 ie. /web001/foo/bar -&gt; web001
set node_name [lindex [split [HTTP::uri] "/"] 1]
if { "" ne $node_name } {
 Now look for the node address in the lookup list
log local0. "Searching for node: $node_name"
set node_addr [findclass $node_name $::node_mapping " "]
if { "" ne $node_addr } {
log local0. "Routing to node: $node_addr " 
node $node_addr
} else {
log local0. "Didn't find node '$node_name' in lookup class"
}
} else {
log local0. "No node name passed in URI"
}
} else {
log local0. "Didn't find [HTTP::host] in lookup class"
}
}
Do you guys have any ideas on this?

joe_pruitt · Answer

It doesn't look like your dumps were added.  I've just added ".txt" as a valid attachment extension to the forums so if you could repost them with a .txt extension that would be great.&nbsp;
&nbsp;Also, in looking at your post, you are telnetting to the host but are not specifying port 80 so telnet should be defaulting to the default telnet port of 23 which shouldn't route to your web server.  You said you received the correct response so I'm a bit confused how you did.&nbsp;
&nbsp;Also, if you could specify why you believe the request is invalid even though it returned a correct response that would help us out.&nbsp;
&nbsp;-Joe

Forum Discussion

iRule for Server Testing

Recent Discussions

Help needed with iRule (connection closed log )

AS3 Limitations

Use of SSL Decryption.

VLAN Failsafe Functionality

FTP PASV mode to Extended Passive mode

Related Content

VIPTest: Rapid Application Testing for F5 Environments

test irules

iRule based RADIUS Server Stack

Testing the security controls for a notional FDX Open Banking deployment

Hey DeepSeek, can you write iRules?

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS