For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

JSC's avatar
JSC
Icon for Nimbostratus rankNimbostratus
Dec 11, 2017

Strange behavior with "DNS::is_wideip" command

We are issuing a strange behavior with the command "DNS::is_wideip".

Documentation say '''This iRules command returns status (true/false) if a string is a configured wide IP. (https://devcentral.f5.com/wiki/irules.dns__is_wideip.ashx)

We declared the wideip 

mydnsalias.domain.com
.

And the iRule:

when DNS_REQUEST {``  
  if { not [DNS::is_wideip [DNS::question name]] } {
    switch -glob [string tolower [DNS::question name]] {
      "a.customdns.name" { }
      default { 
        log local0.info "[DNS::question name] drop" 
        DNS::drop
      }
    }
  }      
}

It works, however we have a lot of log with:

Rule /Common/GTM_FILTER_DOMAIN_IRULE : mydnsalias.domain.com drop

Any clue why the condition is not "always" satisfied?

application delivery
BIG-IP DNS

1 Reply

  • JSC's avatar
    JSC
    Icon for Nimbostratus rankNimbostratus
    Dec 11, 2017

    Adding more logs:

    log local0.info "isWideIP '[DNS::question name]'? -> '[DNS::is_wideip [DNS::question name]]'"

    Here what we got:

    Dec 11 11:39:09  info tmm1[10927]: Rule /Common/GTM_FILTER_DOMAIN_IRULE : isWideIP 'mydnsalias.domain.com'? -> '0'
Dec 11 11:39:09  info tmm1[10927]: Rule /Common/GTM_FILTER_DOMAIN_IRULE : isWideIP 'mydnsalias.domain.com'? -> '1'
Dec 11 11:39:10  info tmm1[10927]: Rule /Common/GTM_FILTER_DOMAIN_IRULE : isWideIP 'mydnsalias.domain.com'? -> '1'
Dec 11 11:39:10  info tmm1[10927]: Rule /Common/GTM_FILTER_DOMAIN_IRULE : isWideIP 'mydnsalias.domain.com'? -> '1'
Dec 11 11:39:10  info tmm1[10927]: Rule /Common/GTM_FILTER_DOMAIN_IRULE : isWideIP 'mydnsalias.domain.com'? -> '1'
Dec 11 11:39:10  info tmm1[10927]: Rule /Common/GTM_FILTER_DOMAIN_IRULE : isWideIP 'mydnsalias.domain.com'? -> '1'
Dec 11 11:39:10  info tmm1[10927]: Rule /Common/GTM_FILTER_DOMAIN_IRULE : isWideIP 'mydnsalias.domain.com'? -> '0'
Dec 11 11:39:10  info tmm1[10927]: Rule /Common/GTM_FILTER_DOMAIN_IRULE : isWideIP 'mydnsalias.domain.com'? -> '1'
Dec 11 11:39:10  info tmm1[10927]: Rule /Common/GTM_FILTER_DOMAIN_IRULE : isWideIP 'mydnsalias.domain.com'? -> '0'
Dec 11 11:39:10  info tmm[10927]: Rule /Common/GTM_FILTER_DOMAIN_IRULE : isWideIP 'mydnsalias.domain.com'? -> '1'
Dec 11 11:39:10  info tmm[10927]: Rule /Common/GTM_FILTER_DOMAIN_IRULE : isWideIP 'mydnsalias.domain.com'? -> '0'
Dec 11 11:39:10  info tmm1[10927]: Rule /Common/GTM_FILTER_DOMAIN_IRULE : isWideIP 'mydnsalias.domain.com'? -> '1'
Dec 11 11:39:10  info tmm1[10927]: Rule /Common/GTM_FILTER_DOMAIN_IRULE : isWideIP 'mydnsalias.domain.com'? -> '0'

    Note: when it happens, it seems to be one in two...