For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

22 Replies

  • spark_86682's avatar
    spark_86682
    Historic F5 Account
    The LB_SELECTED event does file before the server connection is made, yes. I think that LB_SELECTED will fire again if LB::reselect, but I'm not sure.

    I took your iRule and stripped out all the extra stuff so I could concentrate on the real issue at hand. Here's the untested iRule I came up with:

    
    when CLIENT_ACCEPTED {
      TCP::collect 44
    }
    when CLIENT_DATA {
      if { "[TCP::payload 44]" contains "FLUSH" } {
        array unset ::auctiontable
        set SessionID ""
        reject
        event disable all
        return
      }
       Lookup which pool member to use for this SessionID
      set SessionID [substr [getfield  [TCP::payload 44] "@" 2] 0 " DEMP" ]
      set PersistTo "" 
      catch { set PersistTo $::auctiontable($SessionID) }
       If none was found, make an LB decision, and continue execution in LB_SELECTED
       If one was found, use it and we're done.
      if { $PersistTo equals "" } {
        pool [LB::server pool]
      } else {
        event LB_SELECTED disable
        pool [LB::server pool] member $PersistTo
      }
    }
    when LB_SELECTED {
       Since we made an LB decision, we also need to check if another
       connection with the same SessionID made a different LB decision.
      
       If there's still no entry in ::auctiontable, then no other
       connection beat us here, so record the LB decision.
       If there is an entry, then another connection did beat us here,
       so use the recorded decision instead.
      catch { set PersistTo $::auctiontable($SessionID) } 
      if { $PersistTo equals "" } {   
        set ::auctiontable($SessionID) [LB::server addr]:[LB::server port]
      } else {
        event LB_SELECTED disable
        LB::reselect pool [LB::server pool] member $PersistTo
      }
    }

    The comments should explain how it works. I use "catch" to query the auction table, because it very likely performs better than having to create a big list of the key values in ::auctiontable. Hope this helps!
  • Hi,

     

     

    when you do a LB::reselect you will trigger again for sure LB_SELECTED again.

     

     

    HTH