Dear community,
I’m trying to reverse engineer and configure F5 with SNAT enabled for local and distributed static analysis from nginx vendor sample config given:
http {
server {
...
...
location / {
...
...
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_buffering off;
proxy_cache off;
proxy_request_buffering off;
proxy_read_timeout 1w;
proxy_connect_timeout 300s;
}
}
}
For F5 we have deployed HTTP L7 fast profile with cookie and X-Forwarded-For iRule as per the diagram below and SNAT. This is the best we tested out and worked straight with the version of BIGIP we have.
F5 setup
This setup works fine when the static analyzer is running locally on the build server without requesting extra remote build resources via the proxy in the remote service discovery mesh located on the machine storing the static analysis solution. Here is our sample F5 configuration we are currently at.
ltm virtual VIP-SAST-HTTPS {
destination xxx%3404:https
ip-protocol tcp
mask 255.255.255.255
partition foo-tenant-dept-prd
persist {
/Common/HTTP-COOKIE {
default yes
}
ltm persistence cookie HTTP-COOKIE {
app-service none
defaults-from cookie
}
}
pool POOL-SAST-8045
profiles {
/Common/F5-FASTHTTP { }
}
ltm profile fasthttp F5-FASTHTTP {
app-service none
defaults-from fasthttp
}
}
rules {
X-FORWARD-FOR-TEST
when HTTP_REQUEST {
HTTP::header insert X-Forwarded-For [IP::remote_addr]
}
}
serverssl-use-sni disabled
source 0.0.0.0/0
source-address-translation {
type automap
}
translate-address enabled
translate-port enabled
vlans {
xxxsp_lb_vip01
}
vlans-enabled
vs-index 100
However, we’re seeing a problem with passing traffic through the SNAT ingress address when distributed analysis mode is enabled. In this mode, an RPC call from the build server via the proxy is launched first either cronjob or manually or systemd, telling the service mesh on the remote back-end servers where the remote build server is:
ssh server install-sast-rpccmd https://F5_VIP
Later when the analysis starts, the static analyzer is looking into the service mesh on the back-end servers where the free build servers servers are. Then static analyzer opens a master process on a random port on the build server and expects the SNAT ingress address to have the same port open and forwarded to the back-end pool members at the port configured on the backend servers - 8045 in this case.
Sample error message:
Mon Nov 27 16:49:48 2023 Slave 59897 host-sast1] Connecting to master at `SNAT_IP:53034'... (with TLS)
[Mon Nov 27 16:49:48 2023 Slave 27386 host-sast2 Connecting to master at `SNAT_IP:53034'... (with TLS)
msgpass_connect(SNAT_IP:53034) failed: Connection timed out
Connection times out as the port on the SNAT ingress controller is closed and not forwarded further the SNAT IP pool to the backe-end 1:1. Can you please advise how forwarding the source port via the SNAT unaltered can be achieved?
- e.g. having an iRule that traverses the SNAT ingress address and connects to the back-end port or something else? Example from GPT bot for which I need validation
when HTTP_REQUEST {
HTTP::header remove X-Custom-XFF
HTTP::header insert X-Custom-XFF "[IP::client_addr]:[TCP::client_port]"
set my_x_forwarded_for [HTTP::header "X-Forwarded-For"]
set client_ip [IP::client_addr]
set client_port [TCP::client_port]
if { $my_x_forwarded_for ne "" } {
# If X-Forwarded-For header is already set, append the client IP and port
set my_x_forwarded_for "$my_x_forwarded_for, $client_ip:$client_port"
} else {
# If X-Forwarded-For header is not set, set it with the client IP and port
set my_x_forwarded_for "$client_ip:$client_port"
}
# Set the X-Forwarded-For header with the modified value
HTTP::header replace "X-Forwarded-For" $my_x_forwarded_for
}
when HTTP_RESPONSE {
# Disable buffering and caching in the response
HTTP::disable
HTTP::buffering off
HTTP::cache disable
HTTP::request buffer disable
# Set the read timeout to 1 week (604800 seconds)
HTTP::read_timeout 604800
}
=====
when CLIENTSSL_HANDSHAKE {
# Enable SNAT automap
snat automap
}
- Bonus points for adding QoS low delay /high priority from back-ends to build-servers
