Forum Discussion
Session table with Virtual Command
You're right, small data pckts because of ftp-control.
Below is the first iRule calling the second. And then the log. I'd be very interested to see what you think might be happening.
The log lookup of both the STRING value and the $var value on the second virtual server does not work, despite occurring later in time than when they are put in the tables. It seems like they are saved to different tables, or that, the table is somehow reset before the lookup. The IP::client_addr is the same on both virtual servers, so the key is consistent - at least, that's what the log says. When the key is set as a string, it doesn't work either.
iRule 1
when CLIENT_ACCEPTED {
log local0.debug "client accepted VS1"
log local0.debug "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
SSL::disable
TCP::respond "220 My ftp server\r\n"
TCP::collect 10
}
when CLIENT_DATA {
log local0.debug "client data VS1"
log local0.debug "[TCP::payload] is the payload VS1"
log local0.debug "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
TCP::respond "234 AUTH TLS Successful\r\n"
TCP::payload replace 0 [TCP::payload length] ""
log local0.debug "[TCP::payload] is the payload (should be empty) VS1"
log -noname local0.info "CLIENT_DATA found client data"
log -noname local0.info "CLIENT_DATA send to virtual vs-test-02"
virtual /Common/VIP2
SSL::enable
TCP::release
log local0.debug "TCP Release Completed VS1"
}
when SERVER_CONNECTED {
log local0.debug "This is server connected event VS1"
log local0.debug "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
TCP::collect
}
when SERVER_DATA {
log local0.debug "this is server data event VS1"
log local0.debug "[TCP::payload] payload from server VS1"
log local0.debug "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
if { [TCP::payload] contains "220 " } {
TCP::payload replace 0 [TCP::payload length] ""
log local0.debug "[TCP::payload] (empty) payload line (server data event line 27) on VS1"
}
TCP::release
TCP::collect
}
when CLIENTSSL_CLIENTHELLO {
log local0. "This is clientssl_clienthello - VS1"
}
when CLIENTSSL_CLIENTCERT {
log local0. "This is clientssl_clientcert - VS1"
set sidc [SSL::sessionid]
log local0. "CLIENTSSL session ID is $sidc"
set myCount [SSL::cert count]
log local0. "Count of certificates is $myCount"
set client_cert [SSL::cert 0]
<<EXTRACT CERT VALUE in $var local variable>>
log local0. "this is VAR value $var"
set srcip [IP::client_addr]
table add -subtable "blacklist" $srcip "$var" 5 5
log -noname local0.info "send to virtual vs-test-02"
set result [table lookup -subtable "blacklist" $srcip]
log -noname local0.info "result is $result"
}
when CLIENTSSL_HANDSHAKE {
log local0. "This is clientssl_handshake - VS1"
}
when CLIENT_CLOSED {
log local0.debug "Closed TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
}
iRule 2
when CLIENT_ACCEPTED {
log local0.debug "client accepted VS2"
log local0.debug "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
TCP::release
TCP::collect
}
when CLIENT_DATA {
log local0.debug "[TCP::payload] VS2 client data event"
log local0. "This is client data"
log local0.debug [TCP::payload]
log local0.debug "This is line 29"
TCP::release
TCP::collect
}
when SERVER_CONNECTED {
log local0.debug "VS2 server connected event - on inner F5 this is connection to FTP server"
log local0.debug "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
TCP::collect
}
when SERVER_DATA {
log local0.debug "[TCP::payload] server data event VS2"
TCP::release
TCP::collect
}
when SERVERSSL_CLIENTHELLO_SEND {
log local0. "This is SERVERSSL_CLIENTHELLO_SEND - VS2"
TCP::collect
TCP::release
}
when SERVERSSL_SERVERCERT {
log local0. "This is SERVERSSL_SERVERCERT - VS2"
set srcip [IP::client_addr]
set result [table lookup -subtable "blacklist" $srcip]
log -noname local0.info "SERVERSSL_SERVERCERT result for $srcip is $result."
TCP::respond "VAR_$result\r\n"
}
when SERVERSSL_SERVERHELLO {
log local0. "This is SERVERSSL_SERVERHELLO - VS2"
}
when SERVERSSL_HANDSHAKE {
log local0. "This is SERVERSSL_HANDSHAKE - VS2"
}
when SERVERSSL_DATA {
log local0. "This is SERVERSSL_DATA - VS2"
}
- boneyardOct 16, 2019MVP
wow, that is quite something, while i find it weird your ticket(s) with F5 aren't picked up im also a bit worried if they will work on this, as there is a lot of stuff going on.
i would like to built some of it myself but im still a bit confused about what you are doing. is the first VS a plain FTP front to an actual FTPS server?
or is that a way to check client certificates?
but why do you want to do a IP black list check on the second VS, or is this a cleaned up version and normally you do something else?
perhaps you can explain the functional requirement here and there is a better way to solve that.
and looking at your iRule you know more about this then i do, still im a bit woried about all those TCP::collect and TCP::release. are all those needed?
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com