Forum Discussion
Levin_Chen_1516
Nimbostratus
NimbostratusX-Forwarded-For problem?
Hi
I have a iRules as follow:
when HTTP_REQUEST {
if { [HTTP::header exists "X-Forwarded-For"] } {
set xForwardedNum [HTTP::header count "X-Forwarded-For"]
log local0. "Removing - X-Forwarded-For: $xForwardedNum"
if { $xForwardedNum > 0 } {
if attack X-ForwardNum greater than 0, remove and reinsert X-Forwarded-For.
log local0. "Removing and Reinsert - X-Forwarded-For."
HTTP::header remove "X-Forwarded-For"
HTTP::header insert "X-Forwarded-For" [IP::client_addr]
}
}
}
Then I had did enable "Insert XForwarded For" in http profile. I can get log as follow:
Dec 26 11:06:22 tmm tmm[1143]: Rule iRules_secret_snat : Removing - X-Forwarded-For: 0
However, I have do insert "X-Forwarded-For" by "Request Builder"(A tool can add header in client request). Then I can get log as follow:
Dec 26 11:06:08 tmm tmm[1143]: Rule iRules_secret_snat : Removing - X-Forwarded-For: 2
Why [HTTP::header count "X-Forwarded-For"] is zero when enable "Insert XForwarded For" in http profile?
Then I modified iRules as follow:
when HTTP_REQUEST {
HTTP::header insert "X-Forwarded-For" [IP::client_addr]
if { [HTTP::header exists "X-Forwarded-For"] } {
set xForwardedNum [HTTP::header count "X-Forwarded-For"]
set xForwardedValue [HTTP::header value "X-Forwarded-For"]
log local0. "Removing - X-Forwarded-For: $xForwardedNum $xForwardedValue."
if { $xForwardedNum > 0 } {
if attack X-ForwardNum greater than 0, remove and reinsert X-Forwarded-For.
log local0. "Removing and Reinsert - X-Forwarded-For."
HTTP::header remove "X-Forwarded-For"
HTTP::header insert "X-Forwarded-For" [IP::client_addr]
}
}
}
I can get log as follow:
Dec 26 11:36:57 tmm tmm[1143]: Rule iRules_secret_snat : Removing - X-Forwarded-For: 0 10.10.100.13.
hoolioCirrostratus
Oddly enough, HTTP::header count "header-name" starts counting at 0. So you can't tell just from using HTTP::header count "X-Forwarded-For" whether there is no header or one header. I'd call this a bug. If you'd like F5 to address this, you could open a case with F5 Support.
A simple workaround would be to set the HTTP profile to remove the X-Forwarded-For header in the 'Request Header Erase' field. You could then enable the 'Insert XForwarded For' option in the profile and avoid using an iRule altogether. The header to erase option is handled before the insert. So any existing XFF headers would be removed and then LTM would insert a new XFF header with the client IP address it received.
Aaron- hoolioF5 created CR114612 to track this bug where HTTP::header count returns one less than the actual number of headers. You can check with F5 Support or the release notes for status on this CR.
Aaron