Universal Persistence with X-forwarder

Hi,

You can try this example :

when HTTP_RESPONSE {
    persist add uie $clientip
}
when HTTP_REQUEST {
    set clientip ""
    if { [HTTP::header exists "X-Forwarded-For"] } {
        set clientip [HTTP::header "X-Forwarded-For"]
    } else {
        set clientip [IP::client_addr]
    }
    persist uie $clientip
}

Hi,

You can try this example :

when HTTP_RESPONSE {
    persist add uie $clientip
}
when HTTP_REQUEST {
    set clientip ""
    if { [HTTP::header exists "X-Forwarded-For"] } {
        set clientip [HTTP::header "X-Forwarded-For"]
    } else {
        set clientip [IP::client_addr]
    }
    persist uie $clientip
}

Hi,

You should change $xff by $clientip. $xff doesn't exists anywhere.

when HTTP_RESPONSE { 
    persist add uie $clientip 
} 

when HTTP_REQUEST { 
    set clientip "" 
    if { [HTTP::header exists "X-Forwarded-For"] } { 
        set clientip [HTTP::header "X-Forwarded-For"] 
    } else { 
        set clientip [IP::client_addr] 
    } 
    persist uie $clientip 
    log local0. "[IP::client_addr]:[TCP::client_port]: XFF: $clientip" 
}

Hi Yann

Thanks. Got it. Working now. What is the difference between persist add uie $clientip under HTTP_RESPONSE and persist add uie $clientip under HTTP_REQUEST?

The x-forwarded is supposed to come in http-request packet.

Regards,

Sumanta.

Hi Yann

One more query is how to rate limit the connections per XFF IP address? Do we need to modify the rule or write something new?

Regards,

Sumanta.

A formatted version of the "Per VS" rate limiting. You can apply the same irule to all standard VS using UIE persistence.

when RULE_INIT {
    set static::maxReqs 3;
    set static::timeout 60;
}

when HTTP_REQUEST {
        set vs [URI::basename [virtual]]
        if { [HTTP::header exists "X-Forwarded-For"] } {
            set client_IP_addr [getfield [lindex  [HTTP::header values "X-Forwarded-For"]  0] "," 1]
        } else {
            set client_IP_addr [IP::client_addr]
        }
        if { ([HTTP::method] eq "GET") and ([class match [string tolower [HTTP::uri]] ends_with $vs_URI_LIST_TO_LIMIT] ) } {

            whitelist
            if { [class match [IP::client_addr] equals $vs_ips_whitelist] }{
               return
            }
            set getcount [table lookup -notouch "$vs_$client_IP_addr:[HTTP::uri]"]
            if { $getcount equals "" } {
                table set "$vs_$client_IP_addr:[HTTP::uri]" "1" $static::timeout $static::timeout
            } else {
                if { $getcount < $static::maxReqs } {
                    table incr -notouch "$vs_$client_IP_addr:[HTTP::uri]"
                } else {
                    reject
                }
            }
        }
        persist uie $clientip 
}

when HTTP_RESPONSE { 
    persist add uie $clientip 
} 

when RULE_INIT {
    set static::maxReqs 20000;
    set static::timeout 1800;
}
when HTTP_REQUEST {
       if { [HTTP::header exists X-Forwarded-For] } {
           set client_IP_addr [getfield [lindex  [HTTP::header values X-Forwarded-For]  0] "," 1]
        } else {
            set client_IP_addr [IP::client_addr]
        }
        if { ([HTTP::method] eq "GET") and ([class match [string tolower [HTTP::uri]] ends_with URI_LIST_TO_LIMIT] ) } {
            if { [class match [IP::client_addr] equals ips_whitelist] }{
               return
            }
            set getcount [table lookup -notouch "$client_IP_addr:[HTTP::uri]"]
            if { $getcount equals "" } {
                table set "$client_IP_addr:[HTTP::uri]" "1" $static::timeout $static::timeout
            } else {
                if { $getcount < $static::maxReqs } {
                    table incr -notouch "$client_IP_addr:[HTTP::uri]"
                } else {
                    reject
                }
            }
}

when RULE_INIT {
    set static::maxReqs 20000;
    set static::timeout 1800;
}
when HTTP_REQUEST {
       if { [HTTP::header exists X-Forwarded-For] } {
           set client_IP_addr [getfield [lindex  [HTTP::header values X-Forwarded-For]  0] "," 1]
        } else {
            set client_IP_addr [IP::client_addr]
        }
        if { ([HTTP::method] eq "GET") and ([class match [string tolower [HTTP::uri]] ends_with URI_LIST_TO_LIMIT] ) } {
            if { [class match [IP::client_addr] equals ips_whitelist] }{
               return
            }
            set getcount [table lookup -notouch "$client_IP_addr:[HTTP::uri]"]
            if { $getcount equals "" } {
                table set "$client_IP_addr:[HTTP::uri]" "1" $static::timeout $static::timeout
            } else {
                if { $getcount < $static::maxReqs } {
                    table incr -notouch "$client_IP_addr:[HTTP::uri]"
                } else {
                    reject
                }
            }
}

Hi Yann

Getting a whole bunch of errors on this. Can you assist please? I can't debug, not from coding background.

01070151:3: Rule [/Common/iRule_rate_limit] error: /Common/iRule_rate_limit:8: error: [command is not valid in the current scope][if { ([HTTP::method] eq "GET") and ([class match [string tolower [HTTP::uri]] ends_with URI_LIST_TO_LIMIT] ) } ] /Common/iRule_rate_limit:10: error: [undefined procedure: set getcount [table lookup -notouch "$client_IP_addr:[HTTP::uri]"] if { $getcount equals "" } { table set "$client_IP_addr:[HTTP::uri]" "1" $static::timeout $static::timeout } else { if { $getcount < $static::maxReqs } { table incr -notouch "$client_IP_addr:[HTTP::uri]" } else { reject } } ][{ set getcount [table lookup -notouch "$client_IP_addr:[HTTP::uri]"] if { $getcount equals "" } { table set "$client_IP_addr:[HTTP::uri]" "1" $static::timeout $static::timeout } else { if { $getcount < $stat

Regards,

Sumanta.