Total System Global Area 2516582400 bytes Fixed Size 8795904 bytes Variable Size 671090944 bytes Database Buffers 1828716544 bytes Redo Buffers 7979008 bytes Database mounted. SQL> alter database archivelog;
Database altered.
SQL>oh /orcl/app/oracle/oradata/orcl/archivelog
SQL> alter system set log_archive_dest_1='location=/orcl/app/oracle/oradata/orcl/archivelog';
SQL> archive log list Database log mode Archive Mode Automatic archival Enabled Archive destination /orcl/app/oracle/oradata/orcl/archivelog Oldest online log sequence 1 Next log sequence to archive 3 Current log sequence 3
SQL> show parameter recovery;
NAME TYPE VALUE ------------------------------------ ----------- ------------------------------ db_recovery_file_dest string /orcl/app/oracle/fast_recovery _area/orcl db_recovery_file_dest_size big integer 12780M recovery_parallelism integer 0 remote_recovery_file_dest string SQL> alter system set db_recovery_file_dest_size=1G;
System altered.
SQL> show parameter recovery;
NAME TYPE VALUE ------------------------------------ ----------- ------------------------------ db_recovery_file_dest string /orcl/app/oracle/fast_recovery _area/orcl db_recovery_file_dest_size big integer 1G recovery_parallelism integer 0 remote_recovery_file_dest string SQL> select name,open_mode from v$pdbs;
NAME -------------------------------------------------------------------------------- OPEN_MODE ---------- PDB$SEED MOUNTED
ORCLPDB MOUNTED
SQL> alter database open;
Database altered.
SQL> select name,open_mode from v$pdbs;
NAME -------------------------------------------------------------------------------- OPEN_MODE ---------- PDB$SEED READ ONLY
ORCLPDB MOUNTED
SQL> alter pluggable database all open;
Pluggable database altered.
SQL> select name ,open_mode from v$pdbs;
NAME -------------------------------------------------------------------------------- OPEN_MODE ---------- PDB$SEED READ ONLY
MEMBER -------------------------------------------------------------------------------- /orcl/app/oracle/oradata/orcl/redo03.log /orcl/app/oracle/oradata/orcl/redo02.log /orcl/app/oracle/oradata/orcl/redo01.log
SQL> alter database add standby logfile '/orcl/app/oracle/oradata/orcl/stdredo01.log' size 50M;
Database altered.
SQL> alter database add standby logfile '/orcl/app/oracle/oradata/orcl/stdredo02.log' size 50M;
Database altered.
SQL> alter database add standby logfile '/orcl/app/oracle/oradata/orcl/stdredo03.log' size 50M;
Database altered.
SQL> alter database add standby logfile '/orcl/app/oracle/oradata/orcl/stdredo04.log' size 50M;
Database altered.
SQL> select member from v$logfile;
MEMBER -------------------------------------------------------------------------------- /orcl/app/oracle/oradata/orcl/redo03.log /orcl/app/oracle/oradata/orcl/redo02.log /orcl/app/oracle/oradata/orcl/redo01.log /orcl/app/oracle/oradata/orcl/stdredo01.log /orcl/app/oracle/oradata/orcl/stdredo02.log /orcl/app/oracle/oradata/orcl/stdredo03.log /orcl/app/oracle/oradata/orcl/stdredo04.log
7 rows selected.
05,备份主库
创建备份目录
SQL> ho mkdir /home/oracle/dgback/
备份
RMAN> configure channel device type disk format '/home/oracle/dgback/%d_%I_%s_%p.bkp';RMAN> backup as compressed backupset database include current controlfile for standby plus archivelog;
NAME TYPE VALUE ------------------------------------ ----------- ------------------------------ service_names string NODE12C01
这些配置的话需要一 一对应 配置操作命令有下:
alter system set service_names='NODE12C02'; ---更改服务名 alter system set db_unique_name='NODE12C02' scope=spfile; create spfile from pfile='/orcl/app/oracle/product/12.1.0/db_1/dbs/initorcl.ora'; --创建spfile startup nomount pfile='/orcl/app/oracle/product/12.1.0/db_1/dbs/initorcl.ora'; --指定启动 要相互能连接上
[oracle@node12c02 admin]$ sqlplus sys/123456@NODE12C01 as sysdba
SQL*Plus: Release 12.2.0.1.0 Production on Tue Apr 2 22:42:25 2019
Copyright (c) 1982, 2016, Oracle. All rights reserved.
Connected to: Oracle Database 12c Enterprise Edition Release 12.2.0.1.0 - 64bit Production
[oracle@node12c01 admin]$ sqlplus sys/123456@NODE12C02 as sysdba
1）Primary Database 产生的Redo 日志要同时写到日志文件和网络。也就是说LGWR进程把日志写到本地日志文件的同时还要发送给本地的LNSn进程（Network Server Process），再由LNSn（LGWR Network Server process）进程把日志通过网络发送给远程的目的地，每个远程目的地对应一个LNS进程，多个LNS进程能够并行工作。
utl_file_dir string workarea_size_policy string AUTO xml_db_events string enable
001,DB_UNIQUE_NAME配置
alter system set db_unique_name='NODE12C01';
002,FAL_SERVER配置
alter system set fal_server='node12c02,node12c03,node12c04';
fal_server的值写的是tnsname中的服务名，这里主库上设置的fs的服务名是小写的就小写
003,LOG_ARCHIVE_CONFIG配置
dg_config是写db_unique_name的值。
alter system set log_archive_config='dg_config=(node12c01,node12c02,node12c03,node12c04)';
004,log_archive_dest 配置
dest_1还是指向本地归档路径
alter system set log_archive_dest_1='location=/orcl/app/oracle/oradata/orcl/archivelog valid_for=(online_logfile,primary_role) db_unique_name=node12c01';
dest_2原来是指向备库的，现在指向fs机器，使用sync
alter system set log_archive_dest_2='service=node12c03 sync affirm max_failure=1 alternate=log_archive_dest_3 valid_for=(online_logfiles,primary_role) db_unique_name=node12c03';
dest_3这个就设置成指向FS2服务器的，使用async
alter system set log_archive_dest_3='service=node12c04 async alternate=log_archive_dest_2 valid_for=(online_logfiles,primary_role) db_unique_name=node12c04';
rman target /RMAN> restore controlfile from '/orcl/app/oracle/product/12.1.0/db_1/dbs/fs01.ctl';RMAN> exit
启动到mount
SQL> startup mount
— 恢复后再后续的启动中就只需要启动到mount状态即可
设置启动为spfile
SQL> create spfile from pfile;SQL> shutdown immediateSQL> startup
设置参数
db_unique_name 参数配置
alter system set db_unique_name='node12c03';
fal_server配置
alter system set fal_server='node12c01';
这个为主数据库, 配置log_archive_config
alter system set log_archive_config='dg_config=(node12c01,node12c02,node12c03,node12c04)';
写所有集群机器配置dest
log_archive_dest_1，写归档到本地归档路径
alter system set log_archive_dest_1='location=/orcl/app/oracle/oradata/orcl/archivelog valid_for=(all_logfile,all_roles) db_unique_name=node12c03' scope=spfile;
alter system set log_archive_config='dg_config=(node12c01,node12c02,node12c03,node12c04)'; 写所有集群机器
配置dest log_archive_dest_1，写归档到本地归档路径 alter system set log_archive_dest_1='location=/orcl/app/oracle/oradata/orcl/archivelog valid_for=(all_logfile,all_roles) db_unique_name=node12c03' scope=spfile;
log_archive_dest_2，写归档到备库，用async的方式，因为主到fs是sync，fs到备库是async。 alter system set log_archive_dest_2='service=node12c02 async valid_for=(standby_logfiles,standby_role) db_unique_name=node12c02'; log_archive_dest_3, 不用写dest3。
主库所有pdb都要启动 SQL> shutdown immediate SQL> startup read write 配置为读写模式 SQL> alter pluggable database all open read write;
重启备库 --- ---这里FS两个节点是并未启动的状态
SQL> shutdown immediate SQL>startup SQL> alter pluggable database all open read only; --启动到只读模式 SQL> alter database recover managed standby database using current logfile disconnect from session;
启动FAR Sync 节点一
SQL> startup mount
启动FAR Sync 节点二
SQL> startup mount--主库查看保护级别 SQL> select open_mode,protection_mode,protection_level,switchover_status from v$database;OPEN_MODE PROTECTION_MODE PROTECTION_LEVEL SWITCHOVER_STATUS-------------------- -------------------- -------------------- --------------------READ WRITE MAXIMUM PERFORMANCE MAXIMUM PERFORMANCE TO STANDBY
发现并不是最大可用模式,我们进行调整,语法:
SQL> alter database set standby database to maximize availability;Database altered. SQL> select open_mode,protection_mode,protection_level,switchover_status from v$database;OPEN_MODE PROTECTION_MODE PROTECTION_LEVEL SWITCHOVER_STATUS-------------------- -------------------- -------------------- --------------------READ WRITE MAXIMUM AVAILABILITY MAXIMUM AVAILABILITY TO STANDBY
]]><p>Oracle12C–DG Far Sync 部署(前提为搭建好12C的DG)</p>
<h1 id="一-理解同步异步模式"><a href="#一-理解同步异步模式" class="headerlink" title="一,理解同步异步模式"></a>一,理解同步异步模式</h1><h2 id="01-使用LGWR-进程的SYNC-方式"><a href="#01-使用LGWR-进程的SYNC-方式" class="headerlink" title="01, 使用LGWR 进程的SYNC 方式"></a>01, 使用LGWR 进程的SYNC 方式</h2><p>1）Primary Database 产生的Redo 日志要同时写到日志文件和网络。也就是说LGWR进程把日志写到本地日志文件的同时还要发送给本地的LNSn进程（Network Server Process），再由LNSn（LGWR Network Server process）进程把日志通过网络发送给远程的目的地，每个远程目的地对应一个LNS进程，多个LNS进程能够并行工作。</p>
<p>2）LGWR 必须等待写入本地日志文件操作和通过LNSn进程的网络传送都成功，Primary Database 上的事务才能提交，这也是SYNC的含义所在。</p>
<p>3）Standby Database的RFS进程把接收到的日志写入到Standby Redo Log日志中。</p>
<p>4）Primary Database的日志切换也会触发Standby Database 上的日志切换，即Standby Database 对Standby Redo Log的归档，然后触发Standby Database 的MRP或者LSP 进程恢复归档日志。</p>Hey ChatGPT, can you write iRules?http://hexo.abasp.com/pages/%E6%8A%80%E6%9C%AF/Hey_ChatGPT_can_you_write_iRules.html2024-06-23T03:18:00.000Z2024-06-24T04:00:49.778ZHey ChatGPT, can you write iRules?
iRules allow you to parse the payload of the data passing through the BIG-IP and, at wire speed, execute an entire script of commands on that traffic. They allow you to log and redirecting traffic, modify the URI or port or to rewrite the payload itself. iRules and their almost endless capabilities to customize the behavior of F5 Networks’ BIG-IP are one the unique selling point of BIG-IP. Many users of devcentral ask for help with their iRules, consultants who can write or troubleshoot iRules are sought after by many of F5s’ customers. I was wondering how well the new cool kid in town, ChatGPT, performs at writing iRules and how many of the most seen iRules questions on devcentral it can actually answer. Find the most requested iRules I tried to figure out what challenges devcentral users most often look for help with and came up with a list of usual iRule code questions.
iRule challenges I posed to ChatPGT.
Redirect HTTP to HTTPS.
Rewrite the Host header in the request and response.
Do a loadbalancing decission based on the Host header.
Do a loadbalancing decission based on the URI.
Different ASM blocking pages based on the Host header.
Forwarding HTTP requests to HTTPS is a feature that every load balancer can handle and that is often asked for in the forum. The BIG-IP can meet this requirement with both iRules and Local Traffic Policies. Each BIG-IP comes with a collection of pre-installed iRules, an iRule that redirects HTTP to HTTPS is also included (IMHO not a great example, because it sends a 302 Found redirect response that indicates that the resource requested has been temporarily moved to a different URL, I prefer the 301 Moved Permanently redirect status).
The iRule ChatGPT suggests as a solution is the following:
when HTTP_REQUEST { if { [HTTP::header exists "X-Forwarded-Proto"] && [HTTP::header value "X-Forwarded-Proto"] eq "http" } { HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]" }}
This iRule executes on the HTTP_REQUEST event and checks for the presence of an X-Forwarded-Proto header in the request. Such header would only be inserted from another upstream device in front of the BIG-IP, for example another loadbalancer or a CDN. I like that it uses HTTP status 301 (Moved Permanently) instead of HTTP::redirect. However, I would add the options version auto and noserver.
Challenge 2: Rewrite the Host header in the request and response
A common use case for this functionality is when your application servers only accept specific Host headers, but you are publishing your application with a differen FQDN. You want to rewrite the Host header for incoming requests and the Location header for responses, so that the application continues to work with the public FQDN.
ChatGPTs answer:
when HTTP_REQUEST { HTTP::header replace "Host" "newhost.example.com"}when HTTP_RESPONSE { if { [HTTP::header exists "Location"] } { HTTP::header replace "Location" [string map {"oldhost.example.com" "newhost.example.com"} [HTTP::header value "Location"]] }}
No remarks here. Challenge completed.
Challenge 3: Loadbalancing based on the Host header
This function is commonly referred to as Layer 7 loadbalancing or content switching. Behind a VIP there are different web applications, the loadbalancing decision is made either on the basis of the host name or the path portion of the URL. The latter is Challenge 4.
when HTTP_REQUEST { switch -glob [HTTP::host] { "www.example.com" { pool my_pool1 } "api.example.com" { pool my_pool2 } default { pool my_default_pool } }}
No remarks here either.
Challenge 4: Loadbalancing based on the URI
when HTTP_REQUEST { if { [HTTP::uri] starts_with "/app1/" } { pool my_pool1 } elseif { [HTTP::uri] starts_with "/app2/" } { pool my_pool2 } else { pool my_default_pool }}
Looking at the solution for example 4, I’d say that you should know, from experience, that a switch statement will be more performant than an if/else clause at a certain scale. If you are just having 3 or 4 alternatives, the performance gain from using a switch statement won’t be significant. However, I asked ChatGPT to rewrite the same iRule using datagroups to map URLs to pools. This way the solution could easily scale. It did so and even gave a tmsh example to create a datagroup and populate some sample data.
Challenge 5: Different ASM blocking pages based on the Host header.
Sometimes you want to show a custom blocking page, for example to add extra information like the URL or the client IP. Or to add some corporate identity to your blocking page.
when ASM_REQUEST_DONE { if { [ASM::blocking_active] } { switch -glob [HTTP::host] { "www.example.com" { HTTP::respond 403 content "<html><body><h1>Access to this site is blocked!</h1></body></html>" } "www.example2.com" { HTTP::respond 403 content "<html><body><h1>Sorry, this site is not available!</h1></body></html>" } default { HTTP::respond 403 content "<html><body><h1>Access to this site is blocked!</h1></body></html>" } } }}
I have a few comments on this proposed solution. The command [ASM::blocking_active] does not exist. You could probably fix the iRule by using [ASM::status] equals “blocked” or when ASM_REQUEST_BLOCKING instead. Besides that, the usual HTTP response code ASM uses to send a blocking page is 200, also this solution does not include the support ID. I recommend taking a look at Support Solution K22017023 and combining the best of solutions. https://my.f5.com/manage/s/article/K22017023
I have of course asked ChatGPT to adjust the iRule to take my suggestions into account. The new iRule that ChatGPT proposed was even worse.
when ASM_REQUEST_BLOCKED { set block_type [ASM::block type] set host_header [HTTP::header Host] switch -glob $host_header { "www.example.com" { ASM::respond $block_type "<html><body><h1>Access blocked by ASM</h1><p>Your request has been blocked by ASM. Please contact support with the following ID:</p><p>ASM Block ID: [ASM::block id]</p></body></html>" } "www.anotherexample.com" { ASM::respond $block_type "<html><body><h1>Access blocked by ASM</h1><p>Your request has been blocked by ASM. Please contact support with the following ID:</p><p>ASM Block ID: [ASM::block id]</p></body></html>" } default { ASM::respond $block_type "<html><body><h1>Access blocked by ASM</h1><p>Your request has been blocked by ASM. Please contact support with the following ID:</p><p>ASM Block ID: [ASM::block id]</p></body></html>" } }}
This iRule is supposed to execute on the ASM_REQUEST_BLOCKED event, which doesn’t exist. Also the commands [ASM::respond] and the [ASM::block] don’t exist. I think the AI got a little bit too creative here 🙂
Challenge 6: Redirect HTTP request matching a specific path and add a query parameter
The author of this thread asks for an iRule that will redirect the user to a new URL and uses the subdomain portion of the FQDN a query parameter in the new URI. The thread is not marked as “solved”, so I cannot say whether this satisfies the requirements of the user. For the sake of brevity I removed all comments that ChatGTP added. It is worth mentioning, that the comments ChatGPT adds are indeed helpful.
Here is what ChatGPT suggests.
when HTTP_REQUEST { if {[string starts_with [HTTP::path] "/age/signup"]} { set xyz_value [string range [HTTP::host] 0 [expr {[regexp -indices "\\.test\\.com" [HTTP::host]]-1}]] set redirect_url "https://abc.test.com/#/inSign/invite?account=$xyz_value&[HTTP::query]" HTTP::redirect $redirect_url 302 }}
Here is again a lot that goes wrong. The if condition if {[string starts_with [HTTP::path] “/age/signup”]} is just wrong syntax. Correct syntax would be if {[HTTP::path] starts_with “/age/signup”}. Also the next line set xyz_value [string range [HTTP::host] 0 [expr {[regexp -indices “\.test\.com” [HTTP::host]]-1}]] won’t do what you’d expect it to do. If the FQDN is aaa.test.com this won’t extract the full subdomain portion of the FQDN, it will just take the first letter. And the [HTTP::redirect] command does not accept 302 as a flag. Furthermore, what might be missing here, is a check for the value of [HTTP::host] to ensure both conditions of matching the hostname and the URL path are matched. I already mentioned, I am not a fan of the HTTP::redirect command because it uses a 302 Found redirect response rather than a 301 Moved Permanently response. But what I like about this
Here is my working solution.
when HTTP_REQUEST { if {[string tolower [HTTP::path]] starts_with "/age/signup"} { HTTP::redirect "https://abc.test.com/#/inSign/invite?account=[getfield [HTTP::host] ".test.com" 1]&[HTTP::query]" }}
Notice that I use string tolower here. I often use it to make sure my iRule can compare strings case-insensitive.
Challenge 7: Redirect users from one URL to a new URL
when HTTP_REQUEST { if {[string starts_with [HTTP::path] "/Projectsite/"]} { set redirect_url "https://bbb.xyz.com/page/projectdocs-users/" append redirect_url [string range [HTTP::path] 11 end] HTTP::redirect $redirect_url 302 }}
ChatGPT makes the same syntax mistake here, the if condition will cause an error when saving the iRule. if {[string starts_with [HTTP::path] “/age/signup”]} is not valid tcl code, correct is if {[HTTP::path] starts_with “/Projectsite/“}. The string range is off by two characters. In order to remove the string “/Projectsite/“ from the HTTP::path you need to count 13 characters, not 11. I wonder how an AI can be bad at counting… Also here second check for matching the hostname as well as the URL Path would be useful, the use a variable for the redirect URL seems unnecessary and the HTTP::redirect command… enough said about that.
Here is my quick and dirty solution that will work.
when HTTP_REQUEST { if {[HTTP::path] starts_with "/Projectsite/"} { HTTP::redirect "http://bbb.xyz.com/page/projectdocs-users/[string range [HTTP::path] 13 end]&[HTTP::query]" }}
Conclusion
After ChatGPT had solved the first tasks I it quite convincingly, I was quite optimistic that it could also correctly answer the more complex tasks or questions from the devcentral forum. Unfortunately this was not the case, the AI was quite creative in finding solutions but often with wrong syntax and with wasteful use of variables. To correct the syntax errors, you need an F5 specialist again. He will then also have enough experience to develop iRules not only correctly but also in a performant and scalable way. Of course we can expect that the AI will improve over time and hopefully it will soon be able to solve more complex iRule questions for us - I will for sure test it again.
Update
JRahm hinted me to take a another look at the second solution ChatGPT provided. The AI made another mistake here, it reversed the order of the string map. Apologies, I should have noticed that.
ChatGPT:
[string map {"oldhost.example.com" "newhost.example.com"} [HTTP::header value "Location"]
Correct:
[string map {"newhost.example.com" "oldhost.example.com"} [HTTP::header value "Location"]
]]><h1 id="Hey-ChatGPT-can-you-write-iRules"><a href="#Hey-ChatGPT-can-you-write-iRules" class="headerlink" title="Hey ChatGPT, can you write iRules?"></a>Hey ChatGPT, can you write iRules?</h1><p>iRules allow you to parse the payload of the data passing through the BIG-IP and, at wire speed, execute an entire script of commands on that traffic.<br>They allow you to log and redirecting traffic, modify the URI or port or to rewrite the payload itself.<br>iRules and their almost endless capabilities to customize the behavior of F5 Networks’ BIG-IP are one the unique selling point of BIG-IP.<br>Many users of devcentral ask for help with their iRules, consultants who can write or troubleshoot iRules are sought after by many of F5s’ customers.<br>I was wondering how well the new cool kid in town, ChatGPT, performs at writing iRules and how many of the most seen iRules questions on devcentral it can actually answer.<br>Find the most requested iRules<br>I tried to figure out what challenges devcentral users most often look for help with and came up with a list of usual iRule code questions.</p>Accessing TCP Options from iRuleshttp://hexo.abasp.com/pages/%E6%8A%80%E6%9C%AF/Accessing_TCP_Options_from_iRules.html2024-06-23T03:12:00.000Z2024-06-24T04:00:49.730ZAccessing TCP Options from iRules
I’ve written several articles on the TCP profile and enjoy digging into TCP. It’s a beast, and I am constantly re-learning the inner workings. Still etched in my visual memory map, however, is the TCP header format, shown in Figure 1 below.
Since 9.0 was released, TCP payload data (that which comes after the header) has been consumable in iRules via the TCP::payload and the port information has been available in the contextual commands TCP::local_port/TCP::remote_port and of course TCP::client_port/TCP::server_port. Options, however, have been inaccessible. But beginning with version 10.2.0-HF2, it is now possible to retrieve data from the options fields.
Preparing the BIG-IP
Prior to version 11.0, it was necessary to set a bigpipe database key with the option (or options) of interest:
bigpipe db Rules.Tcpoption.settings [option, first|last], [option, first|last]
In version 11.0 and forward, the DB keys are no more and you need to create a tcp profile with the these options defined, like so:
The option is an integer between 2 and 255, and the first/last setting indicates whether the system will retain the first or last instance of the specified option. Once that key is set, you’ll need to do a bigstart restart for it to take (warning: service impacting). Note also that the LTM only collects option data starting with the ACK of a connection. The initial SYN is ignored even if you select the first keyword. This is done to prevent a SYN flood attack (in keeping with SYN-cookies).
A New iRules Command: TCP::optionThe TCP::option command has the following syntax:TCP::option get <option>v11 Additions/Changes:TCP::option set <option number> <value> <next|all>TCP::option noset <option number>
Pretty simple, no? So now that you can access them, what fun can be had?
Real World Scenario: Akamai
In Akamai’s IPA and SXL product lines, they support client IP visibility by embedding a version number (one byte) and an IPv4 address (four bytes) as part of their overlay path feature in tcp option number 28. To access this data, we first set the database key:
tmsh create ltm profile tcp tcp_opt tcp-options “{28 first}” Now, the iRule utilizing the TCP::option command:
when CLIENT_ACCEPTED { set opt28 [TCP::option get 28] if { [string length $opt28] == 5 } { binary scan $opt28 cH8 ver addr if { $ver != 1 } { log local0. "Unsupported Akamai version: $ver" } else { scan $addr "%2x%2x%2x%2x" ip1 ip2 ip3 ip4 set optaddr "$ip1.$ip2.$ip3.$ip4" } }}when HTTP_REQUEST { if { [info exists optaddr] } { HTTP::header insert "X-Forwarded-For" $optaddr }}
The Akamai version should be one, so we log if not. Otherwise, we take the address (stored in the variable addr in hex) and scan it to get the decimal equivalents to build the address for inserting in the X-Forwarded-For header. Cool, right? Also cool—along with the new TCP::option command , an extension was made to the IP::addr command to parse binary fields into a dotted decimal IP address. This extension is also available beginning in 10.2.0-HF2, but extended in 11.0. Here’s the syntax:
May 27 21:51:34 ltm13 info tmm[27207]: Rule /Common/tcpopt_test : IP::addr parse IPv6 output: 2601:1930:bd51:a3e0:20cd:a50b:1cc1:ad13 But in the context of our TCP option, we have 5-bytes of data with the first byte not mattering in the context of an address, so we get at the address with this:
set optaddr [IP::addr parse -ipv4 [TCP::option get 28] 1] This cleans up the rule a bit:
when CLIENT_ACCEPTED { set opt28 [TCP::option get 28] if { [string length $opt28] == 5 } { binary scan $opt c ver if { $ver != 1 } { log local0. "Unsupported Akamai version: $ver" } else { set optaddr [IP::addr parse -ipv4 $opt28 1] } }}when HTTP_REQUEST { if { [info exists optaddr] } { HTTP::header insert "X-Forwarded-For" $optaddr }}
No need to store the address in the first binary scan and no need for the scan command at all so I eliminated those. Setting a forwarding header is not the only thing we can do with this data. It could also be shipped off to a logging server, or used as a snat address (assuming the server had either a default route to the BIG-IP, or specific routes for the customer destinations, which is doubtful). Logging is trivial, shown below with the log command. The HSL commands could be used in lieu of log if sending off-box to a log server.
when CLIENT_ACCEPTED { set opt28 [TCP::option get 28] if { [string length $opt28] == 5 } { binary scan $opt c ver if { $ver != 1 } { log local0. "Unsupported Akamai version: $ver" } else { set optaddr [IP::addr parse -ipv4 $opt28 1] log local0. "Client IP extracted from Akamai TCP option is $optaddr" } }}
If setting the provided IP as a snat address, you’ll want to make sure it’s a valid IP address before doing so. You can use the TCL catch command and IP::addr to perform this check as seen in the iRule below:
when CLIENT_ACCEPTED { set addrs [list \ "192.168.1.1" \ "256.168.1.1" \ "192.256.1.1" \ "192.168.256.1" \ "192.168.1.256" \ ] foreach x $addrs { if { [catch {IP::addr $x mask 255.255.255.255}] } { log local0. "IP $x is invalid" } else { log local0. "IP $x is valid" } }}
The output of this iRule:
: IP 192.168.1.1 is valid : IP 256.168.1.1 is invalid : IP 192.256.1.1 is invalid : IP 192.168.256.1 is invalid : IP 192.168.1.256 is invalid
Adding this logic into a functional rule with snat:
when CLIENT_ACCEPTED { set opt28 [TCP::option get 28] if { [string length $opt28] == 5 } { binary scan $opt c ver if { $ver != 1 } { log local0. "Unsupported Akamai version: $ver" } else { set optaddr [IP::addr parse -ipv4 $opt28 1] if { [catch {IP::addr $x mask 255.255.255.255}] } { log local0. "$optaddr is not a valid address" snat automap } else { log local0. "Akamai inserted Client IP is $optaddr. Setting as snat address." snat $optaddr } }}
Alternative TCP Option Use Cases
The Akamai solution shows an application implementation taking advantage of normally unused space in TCP headers. There are, however, defined uses for several option “kind” numbers. The list is available here: http://www.iana.org/assignments/tcp-parameters/tcp-parameters.xml. Some options that might be useful in troubleshooting efforts:
Opkind 2 – Max Segment Size Opkind 3 – Window Scaling Opkind 5 – Selective Acknowledgements Opkind 8 – Timestamps Of course, with tcpdump you get all this plus the context of other header information and data, but hey, another tool in the toolbox, right?
Addendum
I’ve been working with F5 SE Leonardo Simon on on additional examples I wanted to share here that uses option 28 or 253 to extract an IPv6 address if the version is 34 and otherwise extracts an IPv4 address if the version is 1 or 2.
Option 28
when CLIENT_ACCEPTED { set opt28 [TCP::option get 28] binary scan $opt28 c ver #log local0. "version: $ver" if { $ver == 34 } { set optaddr [IP::addr parse -ipv6 $opt28 1] log local0. "opt28 ipv6 address: $optaddr" } elseif { $ver == 1 || $ver == 2 } { set optaddr [IP::addr parse -ipv4 $opt28 1] log local0. "opt28 ipv4 address: $optaddr" }}
Option 253
when CLIENT_ACCEPTED { set opt253 [TCP::option get 253] binary scan $opt253 c ver #log local0. "version: $ver" if { $ver == 34 } { set optaddr [IP::addr parse -ipv6 $opt253 1] log local0. "opt253 ipv6 address: $optaddr" } elseif { $ver == 1 || $ver == 2 } { set optaddr [IP::addr parse -ipv4 $opt253 1] log local0. "opt253 ipv4 address: $optaddr" }}
]]><h1 id="Accessing-TCP-Options-from-iRules"><a href="#Accessing-TCP-Options-from-iRules" class="headerlink" title="Accessing TCP Options from iRules"></a>Accessing TCP Options from iRules</h1><p>I’ve written several articles on the TCP profile and enjoy digging into TCP. It’s a beast, and I am constantly re-learning the inner workings. Still etched in my visual memory map, however, is the TCP header format, shown in Figure 1 below.</p>
<p>Since 9.0 was released, TCP payload data (that which comes after the header) has been consumable in iRules via the TCP::payload and the port information has been available in the contextual commands TCP::local_port/TCP::remote_port and of course TCP::client_port/TCP::server_port. Options, however, have been inaccessible. But beginning with version 10.2.0-HF2, it is now possible to retrieve data from the options fields.</p>体验用Markdown来写一篇博客文章http://hexo.abasp.com/pages/%E6%8A%80%E6%9C%AF/%E4%BD%93%E9%AA%8C%E4%B8%80%E4%B8%8BMarkdown.html2024-06-22T03:18:19.000Z2024-06-24T04:00:49.577Z体验用Markdown来写一篇博客文章
