For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

frischi_179414's avatar
frischi_179414
Icon for Nimbostratus rankNimbostratus
Dec 24, 2015

Riverbed iRule Performance

Hi

I have a question about an iRule we plan to implement. We cannot test it in a lab and wondered if anyone could help me with an assessment. Will we face a great performance losses or can we use this iRule without any problems?

 

when RULE_INIT {
      set static::OPNET_jscript {
 
      }
}    
when HTTP_REQUEST {

set page_extension [string tolower [HTTP::path]]}


when HTTP_RESPONSE {
  if { [HTTP::status] == 200 } {
        if {[HTTP::header value Content-Type] contains "text"} {
              set stream_find ""
              set stream_find_lower ""
              set insertJscript 1

               Do not allow the Javascript insertion if the pages end with the following
              switch -glob $page_extension {
                    "*.ashx*" -
                    "*.asmx*" -
                    "*.axd*" -
                    "*.js*" {
                          set insertJscript 0
                    }
                    default {
                          if { [HTTP::payload] contains "META HTTP-EQUIV=\"Refresh\""} {
                                set insertJscript 0
                          }
                    }
              }

              if {$insertJscript == 1} {
STREAM::disable
COMPRESS::disable
STREAM::expression "@$stream_find@$stream_find$static::OPNET_jscript@" 
STREAM::expression "@$stream_find_lower@$stream_find_lower$static::OPNET_jscript@" 
STREAM::enable 
                  }
            }
      }
}

 

Thanks for your feedback! Best regards

application delivery
iRules
LTM

1 Reply

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Dec 25, 2015

    Hi Frischi,

    the [STREAM] and also [HTTP::payload] commands are both rather expensive. The total performance impact does strongly depend on your traffic rate and also mix of requested content...

    Some additional thoughts on your code...

    • It would save some cycles to include the $stream_find patter directly to $static::OPNET_jscript. Create two $static:: variables if CASE is that important for you.
    • You may have to remove the Accept-Encoding headers during HTTP_REQUEST in order to make [STREAM] able to parse otherwise compressed content. And you may want to selectivly compress the content on LTM, before sending to clients.
    • To support keep-alive connections you should disable [STREAM] for every not matching response.
    • I duno what type of script you're going to inject into your HTML sites. But how about injecting the code just to err200 and mime-type text/html. It would make things lot easier...
    • I would filter content-type=text/html (matches less % of total request) before err200 for performance reasons.
    • The [HTTP::payload] contains "META HTTP-EQUIV command can't be called without the [HTTP::collect] command.
    • Investigate if a location change of your JScript is possible (e.g. right before or even ). This change may allow you to use STREAM_MATCH events for the META HTTP-EQUIV exception. I guess it would be much better to use [STREAM] only.
    • Didn't know that a [STREAM::expression] command can be called multiple times to create expression lists. Does it really work out?
    • Try to avoid variables as much as possible. (e.g. $insertJscript, $stream_find and $stream_find_lower can be avoided)

    Cheers, Kai