For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Stevenson_88156's avatar
Stevenson_88156
Icon for Nimbostratus rankNimbostratus
Jul 04, 2010

iRule Help!!

I am newbie with iRule and I am just trying out some sample codes to test out how iRule works. I started to developed a simple custom persister whereby a cookie is created to store the serverid on the response and on the request event, it would read the cookie and forward the user to the appropriate member of the pool. As shown below:

 

 

when HTTP_REQUEST { if { [HTTP::cookie exists "cookie"]}{ HTTP::cookie decrypt "cookie" "mykey" set serverid [substr [HTTP::cookie cookie] 10] log local0. "Server Persistence: $serverid" pool TestPoolA member $serverid } else { pool TestPoolA } } when HTTP_RESPONSE { log local0. "Choosen Server: [LB::server]" HTTP::cookie insert name "cookie" value [LB::server] HTTP::cookie encrypt "cookie" "mykey" }

 

 

 

However, when I tried to use this iRule, it wouldn't persist the client user to the chosen pool member even if the log shows the correct value. And by the third or forth connection try, the virtual server could no longer connect to the pool even when the pool is specified in the iRule.

 

 

Note that I did not have the virtual server associated to any default pool and I had also use "one connect" profiles.

 

 

Is this iRule wrong? Any comments and advise regarding this iRule would be gladly be appreciated. Thanks.
application delivery
dev
devops
iRules

3 Replies

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jul 04, 2010
    Hi,

     

     

    What does $serverid show in the HTTP_REQUEST event log entry?

     

     

    I think one issue might be that the pool command requires separate parameters for the pool member IP and port (not a TCL list). Also, I'm not sure why you're using substr to get the first 10 characters of the cookie. Wouldn't you just want the first two fields of the decrypted cookie value?

     

     

    Aaron
  • Stevenson_88156's avatar
    Stevenson_88156
    Icon for Nimbostratus rankNimbostratus
    Jul 04, 2010
    Hi,

     

     

    Thank you so much for your reply, Aaron. You are indeed right that the pool command requires separate parameter values for IP and port. On the log files $serverid displays the following sample value "TestPoolA 10.2.3.48 80". So when I did the substr function, I was able to parse the value "10.2.3.48 80" (the first 10 char in the string that is taken out is "TestPoolA ").

     

     

    The problem I think is that I am just passing the $serverid variable into pool function as one parameter than two thinking that iRule will be able to interpret the space within the variable as two parameters than one.

     

     

    I had done more parsing in the code to separate the IP and the Port and passing two parameters rather than one and the code seems to work. Thanks.
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jul 05, 2010
    I couldn't remember if the pool name was included in LB::server output in HTTP_RESPONSE. If it is, as you've shown, you can use scan to parse the three fields: 

    
when HTTP_REQUEST {

    ...cookie decryption above

    Parse the pool name, IP and port from the cookie
   if {[scan [HTTP::cookie cookie] {%s %s %s} pool ip port] == 3}{

      log loca0. "Parsed $pool $ip $port"

       Select the pool member
      pool $pool member $ip $port

   } else {
      log local0. "Couldn't parse pool, IP and port from [HTTP::cookie cookie]"
   }
}

    Aaron