Forum Discussion

Kevin_Nail's avatar
Kevin_Nail
Icon for Nimbostratus rankNimbostratus
Jan 15, 2009

Multiple XFF headers

We have a situation where it may be possible for one LTM to insert the XFF and load-blance the packets to another LTM with another XFF set.

 

 

I would like to have an iRule the checks for the existence of the XFF header and if it exists then do nothing... else add it in. This is waht I have but it doesn't seem to be working correctly, I am still getting 2 XFF headers in the payload.

 

 

Any help would be appreciated

 

 

when HTTP_REQUEST {

 

if {

 

[HTTP::header exists "X-Forwarded-For"]

 

}

 

{

 

Do nothing

 

}

 

else

 

{

 

HTTP::header insert "X-Forwarded-For" [IP::client_addr]

 

}

 

}
application delivery
dev
devops
iRules

5 Replies

Sort By
  • dennypayne's avatar
    dennypayne
    Icon for Employee rankEmployee
    Jan 15, 2009
    I would try using "return" to exit from the HTTP_REQUEST event. 

        
    when HTTP_REQUEST {    
        if {[HTTP::header exists "X-Forwarded-For"]}    
          return     
       } else {    
          HTTP::header insert "X-Forwarded-For" [IP::client_addr]    
        }    
    }

    Denny

    EDIT: removed extra bracket
  • Deb_Allen_18's avatar
    Deb_Allen_18
    Historic F5 Account
    Jan 16, 2009
    HTTP::header replace will add replace the specified header if it's already there, or add it if it is not.

     

     

    /d
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jan 16, 2009
    I assume you've disabled XFF on the HTTP profile on the second set of LTM's?

    You could also try logging what's happening: 

     
 when HTTP_REQUEST { 
    if {[HTTP::header exists "X-Forwarded-For"]}{ 
        Do nothing 
       log local0. "[IP::client_addr]:[TCP::client_port]: Existing XFF: [HTTP::header values "X-Forwarded-For"]" 
    } else { 
       HTTP::header insert "X-Forwarded-For" [IP::client_addr] 
       log local0. "[IP::client_addr]:[TCP::client_port]: Added XFF: [HTTP::header values "X-Forwarded-For"]" 
    } 
 }

    Aaron
  • Colin_Walker_12's avatar
    Colin_Walker_12
    Historic F5 Account
    Jan 16, 2009
    Don't forget that you don't really need a "do nothing" section of the rule at all. You can accomplish the same thing with negative logic.

     

     

     
 when HTTP_REQUEST {  
   if { !([HTTP::header exists "X-Forwarded-For"])}{  
     HTTP::header insert "X-Forwarded-For" [IP::client_addr]  
     log local0. "[IP::client_addr]:[TCP::client_port]: Added XFF: [HTTP::header values "X-Forwarded-For"]"  
   }  
 }

     

     

    Not that it matters a ton in this case, but in longer, more complex scenarios, this can save a fair amount of code. Also, the header replace option is a good one, that way you should only ever end up with one. This is only an option if you aren't trying to preserve a previous XFF header though, obviously.

     

     

    Colin
  • Kevin_Nail's avatar
    Kevin_Nail
    Icon for Nimbostratus rankNimbostratus
    Jan 16, 2009
    Thanks for all the help... I added the 'return' word and some quotes around the "X-Forwarded-For" value... It works just fine now.