Local Traffic Policy and iRule events
Hi,
I was reading some post about order of execution, in other words if Local Traffic Policy (LTP) executes before or after iRule.
Seems that answer is both 🙂
Scenario:
- VS with all ports allowed
- LTP with TCP port is not equal to any of 80; 443 and action Reset traffic
- iRule with CLIENT_ACCEPTED, HTTP_REQUEST, ACCESS_SESSION_STARTED events (actually few more are in iRule)
Without any mods to iRule effect is like that:
- All commands in CLIENT_ACCEPTED are executed
- LTP is triggered to reset traffic (log action is performed, so I can see it triggers)
- All commands in HTTP_REQUEST are performed
- No command in ACCESS_SESSION_STARTED is executed
- RST-ACK is send to client
- CLIENT_CLOSED event is triggered
So LTP is not preventing CLIENT_ACCEPTED and HTTP_REQUEST events to be triggered but disables other events and resets connection.
I can understand why CLIENT_ACCEPTED is triggered but why HTTP_REQUEST? And why using only matching at TCP connection in LTP causes LTP parameter $1 have http included?
I am as well setting variable via LTP. From logging it is obvious that this variable is not yet created when CLIENT_CONNECTED event is executed but it is when HTTP_REQUEST triggers.
So for some events iRule is executed first for other LTP. Main question is why LTP allows HTTP_REQUEST to be triggered at all? Matching and actions in LTP are only for TCP protocol not HTTP.
Reason I am asking is that I planned to use LTP to limit traffic to specified ports but seems it is not a good solution. Seems that it has to be performed in iRule at least when there is some code to be executed in CLIENT_ACCEPTED as there is no way to disable this event anyhow - or maybe there is?
Implementation of Reset traffic is a bit weird. It is using TCP RST for that even if it is still allowing HTTP request to be processed. I understand that LTP is targeting HTTP traffic handling but then instead of TCP RST we should be able to use HTTP respond to more gracefully end client connection.
I am able to disable HTTP_REQUEST by setting variable in LTP and checking it in HTTP_REQUEST but not in CLIENT_ACCEPTED.
That could be avoided if LTP would not allow HTTP_REQUEST to be triggered.
I guess that limiting traffic for all port VS is then possible in two ways:
- AFM policy
- iRule
Or there is some other way?
Piotr