Forum Discussion
Robert_Sutcliff
Nimbostratus
Nimbostratusmatchclass not returning a result
Hi,
I'm trying to setup a simple blacklist iRule to drop connections from clients with an IP that matches an entry in a DataGroup, and log the relevant entry. I use seperate Host and Network DataGroups for clarity.
However, matchclass isn't returning any value other than 0 - thus connections are always allowed.
The problem statement(s) are (from the code block below)
set idxnet [matchclass [IP::client_addr] equals $::blacklistnet]
set idxaddr [matchclass [IP::client_addr] equals $::blacklistaddr]
If I delete the DataGroups and recreate them, the rule will work for one connection (ie. drops it), then it constantly fails (ie allows connections from a blacklisted machine).
when CLIENT_ACCEPTED {
set idxnet [matchclass [IP::client_addr] equals $::blacklistnet]
log local0. "idxnet = $idxnet - ip = [IP::client_addr]"
if { $idxnet > 0 } {
set valnet [ lindex $::blacklistnet [expr $idxnet - 1] ]
log local0. "Subnet Blacklisted - [IP::client_addr] matched $valnet"
drop
return
} else {
set idxaddr [matchclass [IP::client_addr] equals $::blacklistaddr]
log local0. "idxaddr = $idxaddr - ip = [IP::client_addr]"
if { $idxaddr > 0 } {
set valaddr [ lindex $::blacklistaddr [expr $idxaddr - 1] ]
log local0. "Address Blacklisted - [IP::client_addr] matched $valaddr"
drop
return
} else {
log local0. "Address Allowed - [IP::client_addr]"
}
}
}
The output I get (from the log statments) is -
: indexnet = 0 - ip = xxx.xxx.xxx.xxx
: indexaddr = 0 - ip = xxx.xxx.xxx.xxx
: Address Allowed - xxx.xxx.xxx.xxx
Any ideas?
(We're running BIG-IP 9.4.1 Build 29.0)
5 Replies
Craig_Holland_2Can't say I know why this isn't working, but perhaps using IP::addr function will make the comparisons easier.- IP::addr is not necessary when using matchclass for address comparisons.
Are your datagroups are defined as type "Address" with the appropriate masks?
/deb 
Robert_SutcliffYes, and neither definitions of a host or network are matched
class blacklistaddr {
host 10.148.82.12
}
class blacklistnet {
network 10.148.82.0/24
network 10.148.83.0/24
}- Robert_SutcliffHi,
If I add a stanza as below, it logs that the specific IP address matches
if { [IP::addr [IP::client_addr] equals 10.148.82.12] } {
log local0. "[IP::client_addr] equals 10.148.82.12"
}
However, because I want to match against a set of network addresses in a datagroup, I can't use IP::addr unless I write a whole load of logic to iterate through the datagroup manually - which is where matchclass is supposed to come in...
Rob - Hi Rob --
I don't see anything wrong with your iRule, so I'm going to recommend you open a Support case so they can take a closer look @ what's going on.
/deb
