Colin Walker

DevCentral Top5 11/06/2009

Colin Walker — Sat, 07 Nov 2009 00:18:16 GMT

While ramping up for "The Next Big Thing" continues amongst the DC staff, there is much to talk about in regards to content that's happening in the here and now, not just in the eagerly awaited future (with jet-packs and stuff…). DevCentral has seen its share of cool content this week, as it does every week, so let's talk about what needs talking about. Bringing you everything from TCL strings to a philosophical discussions of when vs. where and which is more important, I'm here with my Top5 picks for the week. And here they are:

When Is More Important Than Where in Web Application Security

http://devcentral.f5.com/weblogs/macvittie/archive/2009/11/06/when-is-more-important-than-where-in-web-application-security.aspx

In this post Lori was as insightful and informative as ever, discussing why being timely is more important, in general, than being perfect when it comes to application security. It's a pretty simple concept to me. When it comes right down to it, no one really cares where you solve a security problem, they care about when you solve it. It's well and good that you want to argue that things should be solved at the app layer vs. the WAF, but if I can provide a solution in 10 minutes...how long is it going to take you to patch every single application for even a miniscule security flaw? I agree just as much with Lori's reminder that WAF and app security models shouldn't compete. They are complimentary in the war against attacks, not mutually exclusive, and should be treated as such.

Every time someone tries to tell you which method is more "proper" or "correct", though, I'd ask them just how much they care about being proper in very real terms. How much is it worth in terms of hours (or days) of their application being exposed? At what point is it worth trading 20, 40, 120 hours of being exposed to a known exploit for an ounce of being "proper", which is already debatable at best, as opposed to getting the fix in place in a fraction of the time? Lori being insightful and informative isn't anything new. She knew she had a solid point to make and I tend to agree. What she didn't know was just how timely she was in setting the stage for her point to be illustrated, but we'll get to that in a moment. They call that foreshadowing, I think. I can tell you're on pins and needles.

20 Lines or Less #31 - Traffic shaping, header re-writing, and TLS renegotiation

http://devcentral.f5.com/weblogs/cwalker/archive/2009/11/06/20-lines-or-less-31-ndash-traffic-shaping-header-re-writing.aspx

Behold, your suspense is relieved! I unveil before your very eyes the payoff to Lori's unintentional setting of the stage. But how, you ask, does the 20LoL tie in with the When vs. Where of App Security? Via the much discussed TLS renegotiation vulnerability that has been burning up the net, of course. When a security measure as deeply rooted and common as TLS encryption is found to be susceptible to attacks, there is much to talk about, and talk they have. It turns out that via a man in the middle attack would-be ne'er-do-wells have the potential to insert information into a renegotiated SSL connection. This is very bad. What's very good, however, is that a user from the DevCentral community drafted a simple fix, at least in their deployment, the very next day. That's the power of iRules. Agility at its very finest, if I've ever seen it. We could debate all day where the best place, technically speaking, to implement the fix is. Or we could just fix it in about 10 minutes of coding and another 30 minutes of testing, and be done with it. That's just one of the rules in the 20LoL, of course. There are two more very cool examples of iRules doing the cool things they do in less than 21 lines of code. Check them out.

iRules 101 - #16 - Parsing Strings with the TCL Scan Command

http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=2346

Jason digs into the amazingly powerful yet often overlooked scan command in his latest contribution to the iRules 101 series. The scan command has some pretty staggeringly powerful capabilities to parse strings in an ultra efficient manner. It takes a little getting used to but it's definitely a command that has potential beyond what's obvious at first glance. Jason does a good job of breaking down some of the options and giving clear examples of not only the command itself but how you might use it in the context of an iRule. Very cool stuff, and worth a read for any current or would be iRulers out there.

Operations Manager Debugging Part I: Top 10 Tools for Developing and Debugging Management Packs

http://devcentral.f5.com/weblogs/jhendrickson/archive/2009/11/04/operations-manager-debugging-part-i-top-10-tools-for-developing.aspx

You've been hearing a lot about the Management Pack lately. That's not likely to change, especially if they keep putting out not only consistent, timely releases with new features, but awesome documentation and commentary along the way. Case in point, Joel Hendrickson put up a blog post this week about his Top 10 favorite tools for the kind of debugging he ends up doing often times as a member of that team. Whether or not you're directly involved with the Management Pack, this is a very cool list. It's interesting to see him walk through each tool, what it does and in some cases how he uses them. I'm always a sucker for hearing a geek talk about … well … being a geek, and that's just what Joel's up to in this informative post. Take a look for all your code debugging needs.

pyControl Just as Happy on Linux

http://devcentral.f5.com/weblogs/jason/archive/2009/11/04/pycontrol-just-as-happy-on-linux.aspx

In response to the many questions asking about pyControl and whether or not it's viable as a Linux solution to iControl programming, Jason put together this tidy little post that not only answers the question (yes, by the way), but shows you just how to get started. This was a cool reminder to me not only of how awesome the pyControl project is, but of just how easy it can be to get started digging into iControl and all the cool things that it can do. With just a few commands, outlined in Jason's post, you can have an environment up and running, ready to start developing. I'm even more excited to see what's coming in pyControl2, whenever I get a chance to play with that. But that's a post for another day.

There you have it, five picks for this week that you just really should not miss. As always, don't be shy with your feedback, and check out previous versions here: http://devcentral.f5.com/Default.aspx?tabid=101

Technorati Tags: DevCentral Top5,iRules,pyControl,TLS,MitM,renegotiation,Linux,Mpack,Colin Walker

#Colin

20 Lines or Less #31 – Traffic shaping, header re-writing and TLS renegotiation

Colin Walker — Fri, 06 Nov 2009 19:42:47 GMT

What could you do with your code in 20 Lines or Less? That's the question I ask (almost) every week for the devcentral community, and every week I go looking to find cool new examples that show just how flexible and powerful iRules can be without getting in over your head.

This week not only are the examples cool and interesting, but one of them at least is extremely timely. You’ve no doubt heard about the client-initiated MITM attack for TLS that was recently disclosed. It’s front-page news around the web and for good reason. While research needs to be done and a real fix needs to be put in place, one crafty community member was quick to draft up a simple fix to at least help mitigate their own issues. And in under 20 lines, no less. Here are this week’s offerings:

Simple traffic shaping

http://devcentral.f5.com/wiki/default.aspx/iRules/Simple_traffic_shaping.html

User JackofallTrades brings us a great example of iRules simplicity via the codeshare. If you’re looking for a way to send folks to different rateclasses based on their usage, this is one way you can get there. It’s highly customizable, too, since it’s an iRule.

when SERVER_DATA {
                set srvAge [IP::stats age]
                set srvBytes [IP::stats bytes in]
                # change 10000ms/10s to your desired time        
                if {$srvAge > 10000 } {
                                # change the recieved bytes if needed
                                if {$srvBytes > 3000000 } { 
                                                 # makesure you create the rate class
                                                rateclass bandHog
                                                #log local0. "Bandwidth Hog: [IP::client_addr] server bytes $srvBytes"
                                }

}              
                
                #log local0. " [IP::client_addr]:[TCP::client_port] server age: $srvAge server bytes: $srvBytes"
}

Rewrite Host header to server name

http://devcentral.f5.com/wiki/default.aspx/iRules/rewrite_host_header_to_server_name.html

Hoolio’s at it again with his latest codeshare entry. In this example he shows how you can write in custom host address headers based on the destination server your request is being sent to. Fun stuff.

when HTTP_REQUEST_SEND {

   # Need to force the host header replacement and HTTP:: commands into the clientside context
   #  as the HTTP_REQUEST_SEND event is in the serverside context
   clientside {

      if {$::host_debug}{log local0. "[IP::client_addr][TCP::client_port]: New [HTTP::method] request to [HTTP::host][HTTP::uri]"}

      # Look up the selected server IP in the datagroup to get the host header value
      set host_header_value [findclass [LB::server addr] $::ip_to_host_class " "]

      if {$::host_debug}{log local0. "[IP::client_addr][TCP::client_port]: Looked up [LB::server addr], found: $host_header_value."}

      # Check if the lookup returned a value
      if {$host_header_value ne ""}{
   
         # Replace the host header value
         HTTP::header replace Host $host_header_value
         if {$::host_debug}{log local0. "[IP::client_addr][TCP::client_port]: Replaced Host header with $host_header_value."}
      }
   }
}

Mitigating the TLS client-initiated renegotiation MITM attack

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=86456&view=topic

Last but certainly not least, user Lupo comes to us with a simple yet hawesome iRule to show an easy way to put a stop to renegotiation MITM attacks in your environment…just so long as you have iRules handy (and don’t need to renegotiate your SSL connections). I love it when users share cool things they’re doing. I love it even more when those cool things are timely, interesting, and almost certainly useful to many other people. Way to go Lupo, thanks for sharing. Note that this, as with all 20LoL entries, isn’t tested/guaranteed/endorsed, etc. But it’s pretty sound logic and I don’t see any good reason it shouldn’t work. Test it in your environment and see for yourself.

when CLIENT_ACCEPTED { 
   # initialize TLS/SSL handshake count for this connection 
   set sslhandshakecount 0 
 } 
  
 # if you have lower priority iRules on the CLIENTSSL_HANDSHAKE event, you have to make sure, that they don't interfere with this iRule 
 when CLIENTSSL_HANDSHAKE priority 100 { 
   # a handshake just occurred 
   incr sslhandshakecount 
  
   # is this the first handshake in this connection? 
   if { $sslhandshakecount != 1 } { 
     # log (rate limited) the event (to /var/log/tmm) 
     log "\[VS [virtual] client [IP::client_addr]:[TCP::client_port]\]: TLS/SSL renegotiation occurred, dropping connection" 
     # close the clientside connection 
     TCP::close 
   } 
 }

There are three more awesome examples for you. 20 lines of code or less packed with all sorts of iRuley goodness to make your lives easier, better, faster or safer. How can you not love that? See you next time.

Technorati Tags: 20 Lines or Less,20LoL,DevCentral,F5,iRules,TLS,MitM,security,rate shape,Colin Walker

#Colin

DevCentral Top5 10/30/2009

Colin Walker — Fri, 30 Oct 2009 19:36:11 GMT

Released into the wild, the DevCentral team is back from our week of being sequestered in a conference room discussing the meaning of life, the universe and everything. Well…everything as it pertains to DC, at least. We even rolled successfully to save against being mauled by zombies or turned into newts (hey…it's almost Halloween, gimme a break…). As such there is plenty of content to pour through this week, including a very cool talk with a newbie to the F5 family. As always I'll give you my picks and hope they serve you well. Here is the Top5 for this week:

Cast Your Vote for Best iRule for the 2009 Contest

http://devcentral.f5.com/weblogs/JeffB/archive/2009/10/29/6170.aspx

We're almost there! I'm sure some of you that were paying close attention have been looking at your calendars with all of the days marked off, waiting with baited breath for the announcement of the winners of this year's iRule Do You? contest. There is but one more person that needs to vote before we can be finished - you! We've made our picks, cast our ballots and bet on our respective ponies, as it were, and now it's time for the community to get involved. Take a minute to go look at the top 6 iRule entries this year. You'll get to feast your eyes on what people are doing with the coolest coding language in the networking world, then vote for your favorite to win the grand prize. Not only is this post informative, but it's interactive as well. Take a few minutes and go take a look at what the community is up to.

DevCentral Weekly Roundup Episode 109 - Branch Cache Chumby

http://devcentral.f5.com/weblogs/dcpodcast/archive/2009/10/29/devcentral-weekly-roundup-episode-109-branch-cache-chumby.aspx

It's all right, I have no idea what the heck "Branch Cache Chumby" means either. Regardless of the title, this week's podcast was very cool. We talked about a few of the usual things as well as Jeff mentioning the above post wherein the community gets to help steer the ship directly for a change, rather than indirectly. Most interesting of all, though, was the in-depth discussion that we had with the guest this week, F5's own James Hendergart. James is a relatively new player on the F5 team but he's got plenty of experience, so he comes across as anything but new. We talked at length about what he and the Business Development team are up to with Microsoft, ranging from Sharepoint to Exchange to Branch Caching and beyond. It's always good to hear what other teams are up to and James has some definite passion about what he's doing, so it turned into a great talk. This one is worth a listen.

A First Look at the F5 PRO-Enabled Management Pack for Microsoft Virtual Machine Manager 2008

http://devcentral.f5.com/weblogs/jhendrickson/archive/2009/10/27/a-first-look-at-the-f5-pro-enabled-management-pack-for.aspx

Speaking of Microsoft, the guys on the Management Pack team are on a roll. They just keep dropping release after release with new, cool features for you to play with. In this post Joel Hendrickson, one of the devs on that team, walks through some of the new bells and whistles in their newest deployment. I love seeing what these guys are going to come up with next, and they haven't disappointed so far. If you've been following or have interest in the management pack at all, I think this is definitely worth a read.

To Take Advantage of Cloud Computing You Must Unlearn, Luke.

http://devcentral.f5.com/weblogs/macvittie/archive/2009/10/28/to-take-advantage-of-cloud-computing-you-must-unlearn.aspx

The unlearning Lori is talking about is all that knowledge you have about application scaling and sizing. It's common practice to over-supply resources for an application. You think the app needs x amount of CPU and y amount of RAM to comfortably run at normal operating levels? Great. Now go buy servers with 2-3x those resources so you can be sure that things are always running smoothly, even during spikes in usage. That might not sound so bad, but what if "x cpu and y RAM" ends up being 40 physical machines worth once you've tripled it? Now scale that out across many applications and you start to see the problem that companies running their own infrastructure have often had to deal with. They have all this capacity going to waste a huge percentage of the time, but they have to have it for those 5 or 6 times a year when usage spikes. This, as Lori says, is one of the large draws to the cloud computing and virtualization model(s). There are a few hiccups, of course, if you treat your options for virtualized resources in the cloud the same as you always have your physical systems. Lori goes into much more depth in her post, I suggest you give it a read to find out more.

20 Lines or Less #30

http://devcentral.f5.com/weblogs/cwalker/archive/2009/10/30/20-lines-or-less-30.aspx

Back at it this week the 20LoL is here with three more great iRules examples courtesy of the community. In this particular case when I say "community" I mean "hoolio". I didn't realize it until after I'd pulled all three examples that they all ended up being from one guy. That's less shocking, though, if you look at the 5,000+ posts Aaron has put out there for the iRulers worldwide. This week I grabbed a couple good ones dealing with pre-loading search queries via http redirects, even more fun with the ever popular nested switch statement, and updating referrer headers in-line. We're darn close to breaking 100 unique iRule examples under 21 lines of code in this series, and every week I love digging around to see what I can find that people are up to in just a few short commands. Take a look if you want to get some ideas on how to use small iRules to have a big impact.

That’s it for this week. As always, check out previous versions here: http://devcentral.f5.com/Default.aspx?tabid=101 and don't be shy with your feedback.

Technorati Tags: Top5,DevCentral,iRules,Cloud Computing,Virtualization,Mpack,Microsoft,Colin Walker

#Colin

20 Lines or Less #30

Colin Walker — Fri, 30 Oct 2009 17:12:56 GMT

Well we made it to 30 editions of the 20LoL. Soon we’ll break 100 iRule examples that are under 21 lines of code each. Pretty neat stuff, if you ask me. This week is the hoolio show, it seems. The guy is just a monster in the forums, what can I say? I sure am glad he’s on our side. I’ve got three examples that I randomly pulled from the forums because I thought they were cool. Only later did I realize that he had penned them all. So big thanks yet again to Aaron and all his hard work to better the community.

Pre-loaded searches based on host name

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=86016&view=topic

This cool little example is a neat spin on a simple HTTP redirect. The basic idea is to redirect to a given search site and set the search parameter to be the original host name of the request. So I could request bobschickenshack.com and be redirected to a search for bobschickenshack on the search page of my choosing. Very cool idea, and darn easy to implement.

 
 when HTTP_REQUEST { 

    # Rewrite the host header to www.yahoo.com and the
    # uri to /search?q=$host where $host is the originally requested hostname 
    HTTP::header replace "www.yahoo.com" 
    HTTP::uri "/search?q=[HTTP::host]" 
 }

More fun with nested switch

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=85807&view=topic

I know we’ve covered switch before, but this is yet another good use of it and I really like the idea of selecting snatpools based on which server the request is going to end up going to. I trimmed this one down a little but only by removing a few of the possible snatpool options, all logic is the same, even though it’s just an excerpt of the overall solution provided.

 when LB_SELECTED { 
    switch [LB::server addr] { 
       222.35.42.126 { 
          switch [IP::client_addr] { 
             192.168.3.11 { snatpool snat_crt_test2 } 
             default { snatpool snat_crt_pool } 
          } 
       } 
       221.218.248.155 { 
          switch [IP::client_addr] { 
             192.168.3.11 { snatpool snat_uni_test2 } 
             default { snatpool snat_uni_pool } 
          } 
       } 
       default { snat automap } 
    } 
 }

Updating referrers

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=85807&view=topic

Hoolio does a good job of not only pointing out the inherent problem with trying to replace referrer headers with hostnames from requests, but giving an option that works as desired even if it’s a little bit different direction than the OP was headed. This is a good example of in-line string replacement with string map, too, which is an often under used command that’s worth a look.

 
 when HTTP_REQUEST { 

    log local0. "[IP::client_addr]:[TCP::client_port]: New [HTTP::method] request to [HTTP::host][HTTP::uri]\ 
       with Referer [HTTP::header Referer]" 

    if {[HTTP::header exists "MyHeader"]} {  
       log local0. "[IP::client_addr]:[TCP::client_port]: Updating Referer to\ 
          [string map -nocase {http:// https://} [HTTP::header Referer]" 
       HTTP::header replace Referer "[string map -nocase {http:// https://} [HTTP::header Referer]" 
    } 
 } 
 when HTTP_REQUEST priority 501 { 
    log local0. "[IP::client_addr]:[TCP::client_port] (501): Current Referer [HTTP::header Referer]" 
 }

There you have it, 3 more iRules to show off just how much you can do in only 20 lines of code. Next time we’ll break past the 100 examples mark. See ya then.

Technorati Tags: 20 lines or less,20LoL,DevCentral,F5,iRules,Colin Walker

#Colin

DevCentral Top5 10/16/2009

Colin Walker — Fri, 16 Oct 2009 22:31:11 GMT

After some much needed vacation I'm back at the helm this week to deliver your Top5. I'm sure you've managed to find some tasty morsels on DevCentral while I was away, but hopefully I'll be able to help out and point you in the direction of some more DC goodness now that I'm back. The past couple weeks have been busy and I have only 5 slots to fill with my picks, so make sure to keep checking out DevCentral if you're looking for more, but here is this week's Top5:

DevCentral Weekly Roundup Episode 107 - The F5 Guy

http://devcentral.f5.com/weblogs/dcpodcast/archive/2009/10/15/devcentral-weekly-roundup-episode-107-the-f5-guy.aspx

The Weekly Roundup is no stranger to the Top5. Indeed I find it's often a valuable entry as it gives some perspective on what the team and community are up to, cool things you should see, etc. It's kind of my way of fitting more than 5 entries into the Top5, but shhh, don’t' tell anyone. This week, however, there's even more reason than normal to check it out. Blogger and F5 expert The F5 Guy graced us with his presence on the cast this week, and it was filled with hawesomeness as was expected when I heard he was joining us. We talked about what he's been up to, how he came to work with F5 gear, what kinds of products and technologies he works with, how and why he started his blog, www.thef5guy.com, and how the team should all have iPhones. Okay, that last part was an inside joke, but it's in there too. In any event, there was some awesome F5 and DevCentral talk going on and if you missed the live stream, you should definitely check out the podcast if you get a chance.

OOW Coverage on DevCentral

http://devcentral.f5.com/weblogs/dmacvittie/archive/2009/10/15/oow-coverage-on-devcentral.aspx

Don made a smart move this week and made a blog post rounding up and listing all the awesome videos that Pete Silva took while attending Oracle's Open World event. So while I'm linking to Don's blog, I think he'll agree that Pete is the one that did the leg work and deserves the credit along with his assorted cast of guests ranging from Calvin Rowland to Andy Ohler to Ron Carovano and beyond. Pete shot a series of short, easily consumed clips interviewing different F5ers at Open World about the event, F5's work with Oracle, what was new and exciting, and their take on the show. It was pretty cool to get a feel for the happenings without actually being there and Pete's classic style and enthusiasm shone through as always. These vids are worth a gander if you're interested to hear about F5 and Oracle. I know I was, and I'm glad I got a chance to watch them.

F5 Management Pack v1.4.1.93 Released: Globalization Support!

http://devcentral.f5.com/weblogs/druddell/archive/2009/09/30/f5-management-pack-v1.4.1.93-released-globalization-support.aspx

The post itself may be short, but the implications and impact are…long? Regardless of my grammatical failings, another new version of the F5 Management Pack has been dropped courtesy of the ever busy MPack team here at F5. If you haven't gotten your hands on the Management Pack yet, you should. There are way too many cool things that you can do to not have at least taken a look yet. With new versions dropping frequently and a steady stream of tutorial content coming straight from the Devs, it's not hard to get started. With this newest release the Management Pack now boasts globalization support to support localized versions of Windows Server 2003 and 2008 R2. This is good news for those worldwide audiences looking to dig further into the world of monitoring and management with the F5 Management Pack. Very cool stuff.

Using Network-Side Scripting to Implement Mock API Endpoints

http://devcentral.f5.com/weblogs/macvittie/archive/2009/10/05/using-network-side-scripting-to-implement-mock-api-endpoints.aspx

It's a shame, really, to try and distill Lori's ever expanding army of posts down to just a single entry for the time I was out, but such is my lot in life. Using the tried and true "throw a dart at the dart-board" method seemed out of the question, so I just picked the one that talked about iRules and had code in it. What…you're surprised? Have you read my stuff before? In this post Lori delves into mocking up an API endpoint in iRules, our very own brand of network-side scripting. It's built to inspect an API call, determine what call it is, then return canned responses based on that call. Pretty cool stuff, right? What's even more cool is that this can end up saving time and resources for plenty of people that happen to have F5's ADC devices already deployed and could use it to test against. I'll admit it, I'm a sucker for a good iRules post, and Lori's got my attention straight away. Good stuff for anyone interested in network-side scripting, APIs, or SOA-ish type stuff.

Creating Cacti Templates for BIG-IP CPU Utilization

http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=4324

Taking you step by step through the process of creating these Cacti templates, all the way from the data collection Perl script to the Cacti configuration, is our resident Cacti expert, Jason. This very cool Tech Tip goes into stellar detail to get you from point A to B without losing you along the way. Complete with big animal pictures and the actual code you'll need to get started, Jason leads you down the path towards a state of Cacti zen. I'm not a huge SNMP or Cacti guy experience-wise, but it's some pretty cool stuff in the right hands and Jason makes it plenty interesting. It's cool to see what he's up to. Take a look for yourself.

There you have it, the Top5 for the week. I'm glad to be back and hope you found this helpful. As always, feedback is appreciated, and you can check out previous Top5s here - http://devcentral.f5.com/Default.aspx?tabid=101

Technorati Tags: DevCentral,Top5,iRules,Oracle,Cacti,The F5 Guy,Colin Walker

#Colin

Do you Rule? Do you … iRule?

Colin Walker — Tue, 29 Sep 2009 17:57:31 GMT

If so, you had better hurry. You’re running out of time to submit your cool, unique, amazing or otherwise interesting iRules to this year’s iRule. Do You? contest. All you have to do is fill out one simple form and you’ll be entered to win some pretty hawesome prizes. If I weren’t disqualified for being an employee (and one of the judges) I would have submitted 10 entries by now for a chance at not only the sweet swag, but the glory of being the #1 iRuler on DevCentral.

This contest is fun, for sure, but it’s also a fantastic way to showcase just how innovative and powerful iRules are. As someone with a deep affection for the technology it makes me extremely excited to see all the entries coming in from around the world. We’ve seen all sorts of solutions, big and small, simple and complex, and all of them have an equal shot. We don’t just want the 400 line monsters. There’s a good chance that some of the iRules from the 20LoL would fare just fine in this contest, if they’re interesting enough.

So take a few minutes, go through your iRules library (what…doesn’t everyone have one?) and dig out your favorite few to submit. It only takes a couple minutes and it’s well worth it.

Technorati Tags: DevCentral,F5,iRules,iRule. Do You?,Contest,Prizes,Colin Walker

#Colin

DevCentral Top5 09/25/2009

Colin Walker — Fri, 25 Sep 2009 23:25:31 GMT

Side-projects and behind the scenes activities abound as the DevCentral team works towards the next goal on our plans for world domination, carefully sketched on Jeff's whiteboard. I'm glad to say that the extended DC team has been helping, as always, to keep the content flowing though, and there's plenty to highlight this week. Take a look at this week's Top5:

Closing in on the iRules Contest Deadline

http://devcentral.f5.com/weblogs/jason/archive/2009/09/15/closing-in-on-the-irules-contest-deadline.aspx

Jason points out a very important, timely fact. It's nearly the end of your window to submit killer iRules for great prizes! The iRules contest is coming to a close. We've gotten some awesome entries so far and I've personally loved seeing them flow in from all over the world. There is still time, though. If you've got an iRule that you use that is cool and unique and warrants sharing, now is the time! Get it submitted and put your bid in for one of the pretty killer prizes offered to the winners. Check out Jason's post to get the details of what they are, where to apply, and a cool example iRule from the forums that could easily be submitted.

Despite Rumors to the Contrary F5 Remains In the Lead

http://devcentral.f5.com/weblogs/macvittie/archive/2009/09/25/despite-rumors-to-the-contrary-f5-remains-in-the-lead.aspx

Lori comes to you this week with an important news bulletin: F5 is still leading the charge in the ADC market, despite the mutterings you may have heard recently. With the release of the new Magic Quadrant from Gartner there is always a fair amount of posturing and hubbub. Lucky are we that our positioning continues to speak for itself, well in the lead. I'm not usually one to go in for marketing type stuff, but the geek in me loves that we have the coolest technology at the party, bar-none. This is one of the many indicators of that, and I was glad to see Lori point it out.

DevCentral Weekly Roundup Episode 104 - Guru, Guy, and My BIG-IP

http://devcentral.f5.com/weblogs/dcpodcast/archive/2009/09/24/devcentral-weekly-roundup-episode-104-guru-guy-and-my.aspx

This week's podcast was a particularly cool one, thanks to the caller that decided to join us. A few weeks ago we started dabbling in live-streaming our podcasts as we record them. This week Joe added the functionality to allow users to call in and chat with us in real-time, while we record. I was pleasantly surprised that we had a community member do precisely that, and share with us what they're currently doing with our tech. If you ever doubt that DevCentral is a far-reaching community with active members, an impromptu call from an international user to chat with us about what they're doing should cure what ails you.

Turn Your Podcast Into An Interactive Live Streaming Experience

http://devcentral.f5.com/weblogs/Joe/archive/2009/09/25/turn-your-podcast-into-a-interactive-live-streaming-experience.aspx

As I mentioned above, the past few weeks we've been adding functionality to our podcasts. This once simple process has become increasingly more complex as we've tried to leverage new and cool features to make them more engaging and interactive for our users. With Joe at the helm we've incorporated several tools that make this possible. Today he put out a blog post detailing just how these all work together and exactly how it is that he crafted this bigger, better mousetrap. I found it quite interesting and it's a neat peek behind the curtains into one of the things we do here in DC Land.

Reduce your Risk

http://devcentral.f5.com/weblogs/psilva/archive/2009/09/24/reduce-your-risk.aspx

In Pete's 13^th of 26 short topics about security he discusses mitigation. He touches on the fact that you should generally assume, if you're dealing with a publicly facing application, that you will eventually be the target of some malicious activity. He also details a few ways in which we all help to mitigate those risks on a daily basis. From firewalls to strong passwords to access cards to secure facilities, there are many hoops we all jump through daily, whether we think about it or not, to try and mitigate the risks inherent in today's IT world. This series is an interesting one and the pieces are easy to digest. I intend to keep following it as it moves towards topic #26, and I recommend you do the same.

There you have it, my Top5 picks from DevCentral for the week. Hopefully you enjoyed them, and I'll be back with more soon. Be sure to check out previous editions of the Top5 here - http://devcentral.f5.com/Default.aspx?tabid=101

Technorati Tags: DevCentral Top5,iRules,iRules Contest,F5,Security,Podcast,Gartner,Colin Walker

#Colin

DevCentral Top5 09/11/2009

Colin Walker — Fri, 11 Sep 2009 23:38:56 GMT

The extended DevCentral team has been hard at work this week, as always, fulfilling your geek needs and then some. As such, this Friday's Top5 brings to you all types of DevCentral-y goodness. From text, to audio, to informative pictures, we've got it all this week. I've picked a few of the best, five to be exact, to share with you. Here they are:

The Threat Behind the Firewall

http://devcentral.f5.com/weblogs/psilva/archive/2009/09/09/the-threat-behind-the-firewall.aspx

Pete Silva dives into drives this week in his piece on the dangers lurking behind seemingly benign usb drives. These undeniably handy devices can do just as much, if not more, harm than good if you're not careful. Pete points out a few ways in which you can find yourself in trouble, and how these devices make up an increasingly large portion of the distribution means for malware infections. I use them, I'm sure you do, and this is an interesting read. It never hurts to be safe with your systems, but to do that you have to know what to watch out for. This is a good read if you're looking to get to know more about how you can stay safe with your usb devices, and knowing is half the battle, or so they say.

iRules Insight - HTTP Event Order

http://devcentral.f5.com/weblogs/jason/archive/2009/09/08/irules-insight-http-event-order.aspx

Jason found a fantastic forum post this week, that featured a pretty darn cool image. An image so cool, in fact, that he turned it into a blog post. There isn't a ton of text to read through, because there's plenty to digest in this image which attempts to detail the logical flow of an iRule firing HTTP events. This is something that might be quite useful for those building or starting to build iRules. I know the event order topic has come up numerous times. There are documents out now that show the order, but I thought this visual representation was very cool. One of the follow-up comments is pretty outstanding also. Go take a look.

WILS: Automation versus Orchestration

http://devcentral.f5.com/weblogs/macvittie/archive/2009/09/10/wils-automation-versus-orchestration.aspx

Maybe it's the fact that she was writing it like Seth, maybe it's because the point came across clearly and made me nod my head repeatedly while I read the piece, maybe it's just because it made me think of orchestras and music and conductors, and I have a soft spot for all those things, but this was my favorite blog post by Lori this week. She had several, as always, and this was by no means the most commented on or the most in-depth. I think it is extremely clear and concise, though, and there is something to be said for both of those things. Discussing the difference between automating a single, rigid, clearly defined task, even if it has multiple steps, and orchestrating an entire process, I.E. many tasks being performed together, each dependant on multiple situational variables, is not an easy thing to do. I think this clear-cut post did it well, so it makes my Top5. Seth would be proud.

20 Lines or Less #29

http://devcentral.f5.com/weblogs/cwalker/archive/2009/09/10/20-lines-or-less-29.aspx

More iRules! Yes, this week brought another edition of the 20LoL. As I near the 30^th edition I talk about HTTP port numbers in a request and how to deal with them, checking pool member status in real-time and reporting it, and some fun with nested switching and pool selection. These are always fun for me to write and I think there's value in them for anyone that's using or looking into iRules. Whether you're an iRule newbie, a veteran, or just trying to figure out what the heck you'd use one for, I recommend taking a look. The 20 Lines or Less is always a good place to get simple, easy to follow examples of iRules doing real world things that benefit real people.

Audio White Paper - Create A Smarter Storage Strategy

http://devcentral.f5.com/weblogs/interviews/archive/2009/09/11/create-a-smarter-storage-strategy.aspx

In another edition of his Audio White Paper series, Pete peps up another storage white paper. If you've been looking to learn more about how you can lighten your storage management burden, but haven't taken the time to dig into the documents that discuss how, you might be able to squeeze in giving this a listen to help you out. The white-paper, linked to from the post, discusses file data growth and how this will continue to be a concern for companies, how there is a wealth of options to the degree of making what to do unclear, and gives some options that might help clear things up. I wasn't convinced that audio versions of white papers would be popular at first. Given the response we've seen over the history of DevCentral, including this series of Pete's, I've become a believer and for good reason. If you don't have the time or inclination to dig through the document itself, the audio version might just do the trick.

There are my five favorites from DevCentral this week. I hope you enjoyed them as much as I did. Let me know if you've got any feedback, as always, and I'll see you next week.

Technorati Tags: DevCentral,F5,Top5,iRules,iControl,Automation,HTTP,Colin Walker

#Colin

20 Lines or Less #29

Colin Walker — Thu, 10 Sep 2009 20:24:50 GMT

29 editions later and still going strong. The 20LoL is a testament to just how many different things can be done with iRules in just a few lines of code. Just imagine the possibilities if this were the 30LoL.

This week I’ve got three more examples, all from the forums. Today we’ll cover dealing with port numbers in HTTP requests, checking pool status from within an iRule, and more fun with nested switching. The community keeps putting out fantastic examples so I just keep on writing about them. Keep it up.

Removing HTTP request port numbers

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=62227&view=topic

Hoolio came up with a trio if examples of how to deal with port numbers in your HTTP requests. All of them are good, depending on your situation, but I’m only going to highlight one here. Go check out the forum post above to see the other two and get the context of the thread.

when HTTP_REQUEST {
# Check if Host contains a colon
if {[HTTP::host] contains ":"}{
# Redirect client to requested host minus the port and preserve the original URI
HTTP::redirect "https://[getfield [HTTP::host] ":" 1][HTTP::uri]"
}
}

Checking pool member status

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=62093&view=topic

User cmbhatt, another one of our power-users, came up with a very cool example of using the LB::select command and HTTP::respond to show the status of a selected pool member. It even has a built in meta-refresh so you can continually monitor the status. Pretty neat stuff.

when HTTP_REQUEST {
 if {[HTTP::uri] eq "/status" } {
 scan [LB::select] %s%s%s%s%d command current_pool command2 current_member current_port
 eval [LB::select]
 set response "<html><head><title>$current_pool Pool Status - [clock format [clock seconds]]</title><meta http-equiv='refresh' content='10; url=http://[HTTP::host]/status'></head>"
 if { [active_members $current_pool] < 1 } {
 append response "POOL NAME:$current_pool CURRENT MEMBER:$current_member:$current_port STATUS: DOWN </body></html>"
 } else {
 append response "POOL NAME:$current_pool CURRENT MEMBER:$current_member:$current_port STATUS: UP </body></html>"
 }
 }
 HTTP::respond 200 content $response "Content-Type" "text/html"
}

More nested switching and pool selection vs. redirection

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&view=topic&postid=62162

This rule stemmed from cmbhatt, once again, then I went in and made some tweaks where I think it made sense, as you can see in the thread. The idea is that the user is looking to do some inspection of first the host, then in some cases, depending on what the host is, the URI as well. Based on what’s found either a load balancing decision is made or a redirect is issued. This is yet another awesome example of how iRules can turn something that would be ridiculously tricky or even impossible elsewhere into something pretty straight-forward.

when HTTP_REQUEST {
switch [HTTP::host] {
    "www.mydomain.eu" {
      switch [HTTP::uri] {
        "/" { HTTP::respond 301 Location "http://www.mydomain.eu/zz/index.html" }
        default { pool mydomain_eu_pool    }
      }
    }
    "www.mydomain.be" {
      switch [HTTP::uri] {
        "/" { HTTP::respond 301 Location "http://www.mydomain.eu/be/zz/index.jsp" }
         default { pool mydomain_be_pool }
      }
    }
    "www.mydomain.nl" { HTTP::respond 301 Location "http://www.mydomain.eu/nl/zz/index.jsp" }
    "www.mydomain.fr" -
    "mydomain.fr" { HTTP::respond 301 Location "http://www.mydomain.eu/fr/zz/index.jsp }
    "www.mydomain.lu" { HTTP::respond 301 Location "http://www.mydomain.eu/lu/zz" }
}
}

There you have it, three more iRules to get you on your way in less than 21 lines of code. Feel free to submit ideas, suggestions of feedback, as always.

Technorati Tags: F5,DevCentral,20LoL,20 Lines or Less,iRules,HTTP,switch,HTTP::respond,Colin Walker

#Colin

20 Lines or Less #28

Colin Walker — Thu, 03 Sep 2009 21:00:53 GMT

Nearing the thirty mark with the 20LoL it occurs to me that I’m having a harder and harder time with something. No, it’s not finding interesting ideas to feature. The community has been absolutely stellar with that part. There are always plenty of iRules for me to grab either directly or with some modification (which is half the fun). No the issue is that I’m having a tough time remembering if I’ve covered a topic too similar to the current one already. Forgive me if I end up double dipping at some point. At the very least it will be a new slant on the idea.

I’m pretty sure this week these are all original concepts. I bring to you examples of SSL and Non SSL traffic sharing a vip in harmony, making use of the scan command to dissect URIs, and some more persistence trickery.

SSL and plaintext living together

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=61869&view=topic

There was a need to serve SSL traffic for all but only a few URIs, and the desire was to use an iRule to do so. Fortunately for the original poster someone was quick to seek out some of hoolio’s earlier work via the search function. In this example you can see how to selectively disable encryption for a particular URI. This could work in the inverse just as easily (selectively enable for only a few secure URIs).

when HTTP_REQUEST {

   # Check if request matches the criteria to disable server-side SSL
   if { [HTTP::uri] starts_with "/clear"}{

      # disable SSL on the serverside context
      SSL::disable serverside

      # select the http pool
      pool http_pool

   } else {
      # default is to use server-side SSL and the https pool
      pool https_pool
   }
}

Multiple Persistence timeouts based on URI

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=61948&view=topic

In a very cool juggling act, hoolio puts on yet another seminar on how to use iRules to meet your tricky and extremely specific needs. He shows here how you can manage a single type of persistence (source address in this case) with multiple timeouts based on the URI that’s requested. The additional trick here is to have the longer timeout not overwritten by the shorter timeout the next time that user requests a URI not in the “extended timeout” list. I like it.

when HTTP_REQUEST {

    # Check requested path
    switch -glob [HTTP::path] {
       "/apps/aml/*" {
          # Persist client for 10 hours
          persist source_addr 36000
       }
       default {
          # Persist client for 1 hour
          persist source_addr 3600
       }
    }
}

Scanning URIs

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=61774&view=topic

The need from the user was to alter multiple variables in a URI. This was complicated further by the structure of the URI and the type of replacement that needed to be done. Aaron (hoolio) though, swift as ever, managed to whip up a tidy solution to the problem making use of the powerful scan command. This one is definitely cool and shows off this under-used command.

when HTTP_REQUEST {

    log local0. "[IP::client_addr]:[TCP::client_port]: New HTTP request to [HTTP::uri]"

    if { [HTTP::uri] contains "adserver/impression" }{
       log local0. "[IP::client_addr]:[TCP::client_port]: Matched URI check"

       # Scan the URI looking for the pid, oid and rand values
       if { [scan [HTTP::uri] {/adserver/impression/pid=%[^/]/oid=%[^/]/rand=%[^/]} pid oid rand] == 3 } {

          log local0. "[IP::client_addr]:[TCP::client_port]: Scanned three values: pid = $pid, oid = $oid, rand = $rand"
          HTTP::uri [string map "adserver/impression/pid=$pid/oid=$oid/rand=$rand/?click ad.imp?pid=$pid&oid=$oid&rand=$rand/?pclk" [HTTP::uri]]
       }
    }
}
when HTTP_REQUEST priority 501 {
    log local0. "[IP::client_addr]:[TCP::client_port]: 501: Updated URI: [HTTP::uri]"
}

There are your three examples for the week in an aggregate 60 lines or less (see what I did there?). Hopefully you’re continuing to find these interesting to read. I’m definitely still enjoying putting them together and want to give yet another massive thanks to the amazing community as a whole and specifically Hoolio for the continued contributions.

Technorati Tags: F5,DevCentral,20 Lines or Less,20LoL,iRules,Colin Walker

#Colin

DevCentral Top5 08/28/2009

Colin Walker — Fri, 28 Aug 2009 23:41:13 GMT

I submit to you my second attempt at this week's Top5 after a vile BSoD swooped down and smote my first attempt into a pile of fiery ash. There were a couple announcements this week on DevCentral along with the expected awesome technical content. I'll try to touch on those as well as a couple other things that you should definitely check out in this week's DevCentral Top5:

Announcing F5 Management Pack 1.4 for Microsoft System Center Operations Manager 2007

http://devcentral.f5.com/weblogs/sfisher/archive/2009/08/25/announcing-f5-management-pack-1.4-for-microsoft-system-center-operations.aspx

The hard-working, quick-moving management pack team here at F5 brings you the newest version of the Management Pack for SCOM. This version includes increased platform support, auth roles integration, built-in discovery, device config and more. If you haven't looked into what the Management Pack can do for you, I highly suggest you take a look. You can check out all sorts of things that the package can be used for in the frequently updated tutorials on DevCentral. If you're using SCOM and have F5 devices, this is definitely something you should look into.

DevCentral Weekly Roundup Episode 100 - The Century Mark

http://devcentral.f5.com/weblogs/dcpodcast/archive/2009/08/27/devcentral-weekly-roundup-episode-100-the-century-mark.aspx

The weekly podcast is not new to the Top5, but this week's is particularly special. This week we crossed the century mark with our 100^th podcast. It took us longer than 100 weeks, but we made it. We've grown immensely as a community and as a team in that time and it was fun to take a few minutes to reminisce on our favorite moments in time with DC. Listen to Jeff talk about electrical storms in Malaysia, Joe talk about sumo wrestling in Japan, and other things that are at least somewhat related to DC and the technology, I promise. Whether you've been with us for years or you're new to DevCentral, this one's a fun look at where we've been and perhaps some hints at where we're going.

Survey iPod Touch Winners + Thanks for the Fantastic Response

http://devcentral.f5.com/weblogs/JeffB/archive/2009/08/27/6076.aspx

Jeff extended a hearty thank you to all of the respondents to the most recent DevCentral survey, and I wanted to point it out and extend mine as well. We got some absolutely fantastic results, with over 500 people responding with some very interesting and useful information. This kind of thing is amazingly useful to driving the DevCentral community forward and making sure we're doing so in a direction that makes the most sense for the members. This one isn't a super deep technical post but it's noteworthy just the same and I wanted to call it out. I'm sure you'll be seeing some snippets of this info as we absorb it and choose bits to share, so keep an eye out and thank you again for your involvement.

The End of DNS As We Know It

http://devcentral.f5.com/weblogs/macvittie/archive/2009/08/28/the-end-of-dns-as-we-know-it.aspx

Lori talks about the imminent death of DNS as we know it, foretelling the rise of GSLB in its place. Given the up and coming infrastructures that seemingly all rely on multiple points of data storage/processing interacting together to deliver a given application, I can see where she'd get that impression. While I'm not quite ready to get the nails out for the coffin, and to be fair that's not what Lori is saying either, I do completely agree with her in that DNS was not designed to handle the demands of the distributed architectures of today and certainly not those of tomorrow. As such it's going to have to be replaced sooner or later. There are already serious pain points when dealing with DNS for applications that demand more of it than it is prepared to deliver, and those issues are only going to continue getting worse, not better. GSLB seems to be the natural successor, with many people already well on-board. Are you ready for the change? If not, it might be time to start thinking about it.

The Importance Of Integration In The Future Of The Cloud With BlueLock

http://devcentral.f5.com/weblogs/interviews/archive/2009/08/25/the_future_of_the_cloud_with_bluelock.aspx

Tune in as Ken Salchow talks with Pat O'Day from BlueLock about cloud computing, F5's role in making some of the features BlueLock offers possible, and how important integrating that technology with server virtualization technology is to them. If you're looking for an inside scoop on what at least one cloud provider is up to, what they're thinking and how they're doing what they do, this is a pretty cool look at just that. It also provides some solid insight into how virtualization of both the hardware and network resources is vital to making the scaling that clouds are so famous for possible. I enjoyed getting to hear from the horse's mouth how these technologies are being put to use today to produce a robust platform for your application.

That's the Top5 for this week. If you've got questions, comments or otherwise, don't hesitate to drop me a line. You can always check out previous editions of the Top5 here - http://devcentral.f5.com/Default.aspx?tabid=101

Technorati Tags: DevCentral,F5,DC Top5,BlueLock,Management Pack,Colin Walker

#Colin

20 Lines or Less #28

Colin Walker — Tue, 11 Aug 2009 17:50:40 GMT

Today I bring you a few more fine examples of iRules kung fooery in a brief fashion. These tidbits of iRuley goodness could be used by themselves, as the beginning to a bigger project or solution, or just to get the creative coding juices flowing for you to think of what you might need or want to do with iRules in your world. To me, it’s just a great way to look at what’s being done, how people are using the technology, and what can be achieved in just a few lines of code.

Modifying Secure Access Manager session variables

http://devcentral.f5.com/wiki/default.aspx/iRules/Modifying_Secure_Access_Manager_v8_session_variables_with_a_cookie.html

From the CodeShare comes a very cool entry, complete with diagrams and pictures (yay pictures!), that shows us how we might use iRules in conjunction with another product. The author gives a full description in the link above, so follow that for all the details, but to quote briefly, “In this example, an external server is used to authenticate users before passing those authentication credentials over to the Secure Access Manager (SAM v8) using a cookie.” Cool stuff. The iRule is below but there’s more to this one so click on the link to check it out.

when HTTP_REQUEST {
#Check to see if a cookie exists, otherwise no need to do anything.
#You should probably also check to see if the session variables are already set before doing anything
#as well, but this code is just for demonstration purposes.
if { [HTTP::cookie exists MySAMCookie] } {
    #Log the session state - this is just for demonstration purposes
    #SAM allows you to gather the values of session variables with the SESSION::data command
    log local0. "Session ID is $tmm_fp_session_id and the status is [SESSION::data get $tmm_fp_session_id \"session.state\"]"

    #Use the SESSION command to set the userID and password
    #session variables to what was in the cookie. The userID and password are just cookie values

    SESSION::data set $tmm_fp_session_id session.logon.last.username [HTTP::cookie MySAMUser]
    SESSION::data set $tmm_fp_session_id session.logon.last.password [HTTP::cookie MySAMpw]
}
}

Replace absolute URLs in redirects

This one comes from email so there’s no link, but it’s straight-forward and well commented. The idea is a good one. If a URL is being passed through in the location header of a redirect and it’s an absolute location, change it to be relative. Very handy.

# This will rewrite the Location header on a redirect from a absolute URL like
#
#         http://host/images/ to /images/
# or
#         like https://host/images/ to /images/
#
# The only case it will not handle is http:/// which will get rewritten to "" which is invalid
#

when HTTP_RESPONSE {
if { [HTTP::is_redirect] } {
    if { [HTTP::header "Location"] starts_with "http" } {
      HTTP::header replace "Location" [substr [HTTP::header "Location"] [string first "/" [HTTP::header "Location"] 8]]
    }
}
}

Persisting on part of a cookie name

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=60792&view=topic

This user wanted to use cookie persistence but was looking to setup persistence for cookies that began with a certain string. This means he wanted to loop through all cookies and compare them each against a static search string. They figured out their own solution though, so kudos to them.

#HTTP responds catches the first responds from the node to back to the client.
#It checking all cookies in the header and grabs all starting with 1234.
#After it adds the cookie value to the persistence table and log values to syslog.
#Else persist the client for 60 minutes based on source IP with /32 mask and log values to syslog.

when HTTP_RESPONSE {
foreach a_cookie [HTTP::cookie names] {
    if {$a_cookie starts_with "1234"}{
      persist add uie [HTTP::cookie "$a_cookie"]
      log local0.debug "Cookie persist - client IP: [IP::client_addr], Cookie: $a_cookie, Server IP: [IP::server_addr]"
    } else {
      persist source_addr 255.255.255.255 3600
      log local0.debug "Source persist - client IP: [IP::client_addr] , Server IP: [IP::server_addr], lookup [persist lookup uie [IP::client_addr]]"
    }
}
}
#HTTP request catches the first responds from the node to back to the client.
#It checking all cookies in the header and grabs all starting with 1234.
#After it persist on the cookie value in the persistence table.
#Also, log values to syslog

when HTTP_REQUEST {
foreach a_cookie [HTTP::cookie names] {
    if {$a_cookie starts_with "1234"}{
      persist uie [HTTP::cookie "a_cookie"]
      log local0.debug "Client IP: [IP::client_addr], Cookie value: $a_cookie"
    } else {
      persist uie [IP::client_addr]
      log local0.debug "Source IP Persistence used - Client IP: [IP::client_addr], Persistence entries used persist uie [persist lookup uie [IP::client_addr]]"
    }
}
}

There you have it, three more awesome iRule examples from three different sources. You’ve got to love that. Keep those examples coming whether it’s in the forums or the CodeShare, and don’t forget you can always email me to toss out ideas, ask for things you’d like to see, discuss your favorite X-Men character, or whatever suits you.

Technorati Tags: DevCentral,20Lines or Less,iRules,Persistence,Cookies,Colin Walker

#Colin

DevCentral Top5 08/07/2009

Colin Walker — Fri, 07 Aug 2009 21:48:15 GMT

As the extended DevCentral crew continues to crank through the summer months, churning out more and more awesome content, there is lots to see. Whether you're looking for short, easily consumable pieces of media to get you pointed in the right direction or longer posts about the practicality of running your crew or your servers close to the ragged edge, I've got both for you this week. Check out this week's Top5:

pyControl Apps #2 - Deleting BIG-IP Routes

http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=2318

In Jason's continuation of the pyControl Apps series he continues to walk you through how to get moving with pyControl to perform some useful actions on your BIG-IP. In this installment Jason walks through how to delete the routes that he showed you how to create in the last pyControl Apps article. He continues to expand upon the idea of using python and iControl together, giving you building blocks to a larger application or utility that could eventually do one of many possible things in your deployment. I'm curious to see what comes next in the series and this one is worth a quick read.

Audio White Paper - Load Balancing 101 Nuts and Bolts

http://devcentral.f5.com/weblogs/interviews/archive/2009/08/06/audio-white-paper-load-balancing-101-nuts-and-bolts.aspx

If you're still not 100% clear on load balancing, Application Delivery Networking, and their role in your application's world, here's a great way to clear all of that up. Pete Silva takes a few minutes to clarify in very simple terms what all of these things are and what they can do. He covers everything from the basic terminology of the devices and configurations to the life cycle of a connection within the Load Balancer's world to in-line manipulation of content at the network level. In this audio version of the load balancing 101 whitepaper Pete gives a solid basis to work with for anyone that is just getting their feet wet in the LB / ADC world(s). If you're (or someone you know is) looking for a place to get started, this wouldn't be a bad place. Make sure you check out the pdf linked to in the post for the diagrams and shiny pictures.

There's a New iRule Editor in Town

http://devcentral.f5.com/weblogs/Joe/archive/2009/08/05/theres-a-new-irule-editor-in-town.aspx

The iRule Editor, for those of you that have been living under a rock or in a particularly out of the way cave for quite some time now, is an amazingly powerful tool for writing, deploying, testing, troubleshooting and archiving iRules. It's my go-to tool every time I even think about looking at or coding an iRule. It was that good before, and it just got better. Joe has implemented some fixes to bugs in the previous versions and some shiny new enhancements such as new GTM only iRules commands. If you've been using this, grab the new version. It's better, faster, stronger…you get the idea. If you haven't been using this and you use, are thinking about using, or come within 4 square miles of contact with an iRule I highly, highly recommend you pick this up and take a look. It's game-changing in the iRules dev experience. It's so good, in fact, that word on the street is that someone who will remain un-named may be looking into a Linux version as well for all of those non-MS types. Check it out, you won't regret it.

Formula for Quantifying Productivity of Web Applications

http://devcentral.f5.com/weblogs/macvittie/archive/2009/08/04/a-formula-for-quantifying-productivity-of-web-applications.aspx

More is not always better. More utilization, even when there is more overhead technically available is not always a good thing. Lori points this out quite well and far better than I could in her recent blog post. Her discussion around the maximum realistic capacity of people/devices and the amount of fallout there is for pushing past that is something that I've understood inherently for some time, but enjoyed seeing put down in black and white. Yes, if your server is at 75% capacity you can technically squeeze another 24% utilization out of it. Realistically though, bad things will happen. Read more to find out what, why, and what to do about it.

20 Lines or Less #27

http://devcentral.f5.com/weblogs/cwalker/archive/2009/08/06/20-lines-or-less-27.aspx

Yes, another 20LoL in the Top5. Yes, I really think it's that cool. Three more examples of what can be done with the power of iRules in less than 21 lines of code warrants a spot this week. This week we've got an example dealing with switch statements, one dealing with pool information in HTTP headers, and one that has to do with mod_rewrite rewriting. If you're looking for code snippets that you can grab and use or store for later, or if you're just trying to figure out what the possibilities are with this whole iRules thing, this series is a great place to check things out. Take a look at the 27^th edition and see what you think. Then, if you like what you read, dig back through the previous 26 for over 70 code samples of nifty iRule-ey goodness.

There's your Top5 for the week. I hope, as always, that you've not only enjoyed it but found it useful. Feel free to drop me a line about what you'd like to see, what you're missing, or general comments and feedback. Otherwise, I'll be back soon with 5 more from DevCentral.

Technorati Tags: DevCentral Top5,iRules,iRule Editor,20 Lines or Less,pyControl,Productivity,Colin Walker

#Colin

20 Lines or Less #27

Colin Walker — Thu, 06 Aug 2009 20:17:28 GMT

Here are a few more cool iRules from the forums. This week I’ve included one of the simplest, shortest iRules to ever make the 20LoL. It just struck me as something quite useful that I’m willing to bet several people will look at and say “oh, that’s handy” despite the fact that it’s not complex or long. Keep the code coming.

Multiple Matches with Switch

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=60678&view=topic

Joe answered a plea for help from the forums that showed how to modify an existing iRule that mad use of switch dropping through to multiple match cases. This is a great way to streamline your rule and I wanted to post this here as it’s a good example of what it looks like.

when HTTP_REQUEST {
   switch -glob [string tolower [HTTP::uri]] {
     "/xml/order.asp*" -
     "/xml/status.asp*" -
     "/vmsxml/order.asp*" -
     "/vmsxml/status.asp*" -
     "/_xmlbeta/status_mismo21.asp*" -
     "/_xmlbeta/status.asp*" -
     "/_xmlbeta/rels_status_mismo21.asp*" -
     "/vendor/status.asp*" {
       pool host.mydomain.com_B2B_HTTPS
     }
     "/BatchProcessing*" {
       pool host.mydomain.com_BatchPro_HTTPS
     }
     default {
       pool host.mydomain.com_GUI_HTTPS
     }
   }
}

Mod_Rewrite to iRules conversion

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=62642&view=topic

Hoolio strikes again with this awesome conversion of some mode rewrite rules into an iRule format. This is extremely handy for centralizing and streamlining these types of rewrites. He makes it look so easy, doesn’t he?

when HTTP_REQUEST {

    log local0. "[IP::client_addr]:[TCP::client_port]: Original URI: [HTTP::uri]"

    # Check if URI matches first format using scan
    if {[scan [HTTP::uri] {/%[Oo]ffers/%[0-9:].html} a b] == 2}{

       # Scan matched two strings, so rewrite the URI with the second match value
       HTTP::uri "/pages/ViewOffer.aspx?id=$b"

    } elseif {

       # Continue with next rule
    }
}
when HTTP_REQUEST priority 501 {

    # This event is added for debug only to log the updated HTTP::uri value
    # Comment it out/remove after testing is complete
    log local0. "[IP::client_addr]:[TCP::client_port]: Updated URI: [HTTP::uri]"

}

Insert Pool Info

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=60663&view=topic

In likely the shortest, simplest iRule to date in the 20 Lines or Less, hoolio shows how to insert information about the chosen pool into a header on a server response. This one struck me as useful enough to post. I usually go for things that are a little more flashy but there’s something to be said for simplicity if it gets the job done.

when HTTP_RESPONSE {

# Insert pool name, member IP:port in a header named Pool-Info
HTTP::header insert Pool-Info [LB::server]
}

The things that you can do in less than 21 lines of iRules code continue to amaze and interest me, so I’ll be back next week with three more examples of just how much you can accomplish in those scant few lines of code.

Technorati Tags: 20LoL,DevCentral,F5,iRules,20 Lines or Less,Colin Walker

#Colin

20 Lines or Less #26

Colin Walker — Thu, 23 Jul 2009 20:45:40 GMT

This week we’ve got more cool iRules toys to show off. That’s not the impressive part, the impressive part is that only two of the three examples are from hoolio. I know, right? Joking aside, a huge thank you to hoolio for his astounding contributions to the community, and to everyone else that’s out there posting questions, answers and examples of what iRules, iControl and all the other F5 technologies can do.

Okay, love-fest out of the way, let’s iRule…

Nested URI Rewriting

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=60448&view=topic

In this example hoolio shows how you can use a switch statement to simplify performing a couple of URI rewrites based on the hostname. The example is a clean way to achieve something that can quickly get messy and hard to debug when using if/else chains.

 when HTTP_REQUEST { 
    switch [string tolower [HTTP::host]] { 
 	 "keyaccount.company.com" { 
          # Rewrite / to /path/path/index.html 
          if {[HTTP::path] eq "/"}{ 
             HTTP::uri "/path/path/index.html" 
          } 

          # Rewrite host header to keyaccount.othercompany.com 
          HTTP::header replace Host "keyaccount.othercompany.com" 

          # Use pool1 
          pool pool1 
      } 
 	 "keyaccount.company.com" { 
          # Rewrite / to /path/path/index.html 
          if {[HTTP::path] eq "/"}{ 
             HTTP::uri "/path/path/index.html" 
          } 

          # Rewrite host header to keyaccount.othercompany.com 
          HTTP::header replace Host "keyaccount.othercompany.com" 

          # Use pool1 
          pool pool1 
       } 
       default { 
          # Take some default action for other host header values? 
       } 
    } 
 }

Partial Hostname Rewrite

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=60325&view=topic

User cmbhatt chimed in with a solid response to a request looking for hostname re-writing. Rather than perform some more complex splitting, lreplacing and joining he makes use of the string map command to reduce the complexity and number of steps. This one’s another good example of making something that’s easy to read, useable and portable.

 when HTTP_REQUEST {  
   if { [matchclass [string to lower [HTTP::header "User-Agent"]] contains $::useragent_list ] }  {  
     HTTP::redirect "http://[string map -nocase {"www." "m." } [HTTP::host]][HTTP::uri]" 
   } else {  
     HTTP::redirect "http://[string map -nocase {"www." "www2." } [HTTP::host]][HTTP::uri]" 
   } 
 }

IP based login control via iRules

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=60333&view=topic

Hoolio’s back (shocking) with another awesome example. His response to player’s request for some user access control guidance resulted in a good look at how you can use a simple iRule to make quick work of login restrictions. This is a great way to allow only certain people access to given areas of a site.

when HTTP_REQUEST {

    # Check requested path
    if {[string tolower [URI::decode [HTTP::path]]] eq "/web/admin.aspx"}{

       # Check login parameter value
       if {[URI::query [HTTP::uri] "login"] eq "1"}{

          # Request to restricted resource. Check if client IP is not 1.1.1.1
          if {not ([IP::addr [IP::client_addr] equals 1.1.1.1])}{

             # Take some action to prevent request?

             # Rewrite login=1 to login=2
             #HTTP::uri [string map {login=1 login=2} [HTTP::uri]]

         # Redirect client to rewritten URI?
             #HTTP::redirect [string map {login=1 login=2} [HTTP::uri]]
          }
       }
    }
}

There they are for this week, three more examples of iRule foo in less than 21 lines of code. Check out more 20 Lines or Less posts here.

Technorati Tags: 20LoL,DevCentral,F5,iRules,20 Lines or Less,Colin Walker

#Colin