For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

OTS02's avatar
OTS02
Icon for Cirrus rankCirrus
Sep 30, 2015

STREAM iRule question

I have a test configuration that routes traffic to/from middleware-servers to database server, through an LTM Virtual Server. I have an iRule applied to the VS that uses STREAM to look for some bad omens. It has been working mostly, but there are times when users get database connection errors. Here is the iRule:

when SERVER_CONNECTED {

set DNAserver [IP::client_addr]
TCP::collect

}

when SERVER_DATA {

 find impending doom signals
STREAM::expression {@ORA-12537@ORA-12537@@ORA-06502@ORA-06502@@ORA-00060@ORA-00060@@ORA-12547@ORA-12547@@ORA-12606@ORA-12606@@ORA-03135@ORA-03135@}
STREAM::enable
TCP::release

}

when STREAM_MATCHED {

set hsl [HSL::open -proto UDP -pool HIGH_SPEED_LOGGING] 
HSL::send $hsl "hsl_BL_DNA_sandbox, STREAM matched: [STREAM::match], DNA Server $DNAserver"
STREAM::disable

}

My question is - would it be a good idea to place a "STREAM::disable" after the "TCP::release", under the "when SERVER_DATA" event?

2 Replies

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Sep 30, 2015

    STREAM_MATCHED is typically called when a) you want more flexibility that a STREAM::expression will give you, and b) you're not also replacing the data in the STREAM::expression. Example:

    when SERVER_DATA {
    STREAM::expression {@this@@ @that@@ @something@@}
    TCP::release
}
when STREAM_MATCHED {
    if { some logic for STREAM::matched } {
        STREAM::replace "the data that you'd otherwise put in the replace part of the delimited STREAM::expression"
    }
}

    Plus, if you put the STREAM::disable in the STREAM_MATCHED event, it'll replace the first thing it sees and then turn itself off for the rest of the TCP connection. I'd probably move the STREAM::disable to the SERVER_CONNECTED event (unless this is intentionally what you want it to do).

  • OTS02's avatar
    OTS02
    Icon for Cirrus rankCirrus
    Sep 30, 2015

    Thanks Kevin,

     

    I will give it a try - moving the STREAM::disable to the SERVER_CONNECTED event.