F5 Agility Labs - Index

Welcome

Welcome to the Cooking with iRules - HTTP lab at F5 Agility 2020

The content contained here leverages a full DevOps CI/CD pipeline and is sourced from the GitHub repository at https://github.com/f5devcentral/f5-agility-labs-irules. Bugs and Requests for enhancements can be made using by opening an Issue within the repository.

Getting Started

Please follow the instructions provided by the instructor to start your lab and access your jump host.

Note

All work for this lab will be performed exclusively from the Windows jumphost. No installation or interaction with your local system is required.

Lab Topology

The following components have been included in your lab environment:

  • 2 x F5 BIG-IP VE (v12.1)
  • 1 x F5 iWorkflow VE (v2.1)
  • 1 x Linux LAMP Webserver (xubuntu 14.04)
  • 1 x Windows Jumphost
Lab Components

The following table lists VLANS, IP Addresses and Credentials for all components:

Component VLAN/IP Address(es) Credentials
Sample Host
  • Management: 10.1.1.250
  • Internal: 10.1.10.250
  • External: 10.1.20.250
 admin/admin

Cooking with iRules - HTTP

This class covers the following topics:

  • HTTP Protocol Review
  • HTTP Request Side Overview
  • HTTP Response Side Overview
  • HTTP Related Events
  • HTTP Headers
  • STREAM Command
  • HTTP Payload Capture and Manipulation (If time permits)
  • SSL::profile (If time permits)

Expected time to complete: 1.25 hours

Note

All work for this lab will be performed exclusively from the Windows jumphost. No installation or interaction with your local system is required.

Lab Components

The following table lists the Credentials for all components:

Component VLAN/IP Address(es) Credentials
BigIP Management: bigip1 admin/admin.F5demo.com
Jumphost Jumphost: TBD external_user/P@ssw0rd!
Cooking with iRules Labs

This is the collection of HTTP Labs. Here is where you get to prove you listened in class :)

Lab 1 - Create an iRule that Parses the URI to Route Traffic
Creating your first HTTP iRule that routes traffic based upon the value of the Host name.

The goal of this lab is to route incoming HTTP requests to a specfic pool based on the incoming http host name.

Please create an iRule that will route traffic based on the following table:

Host Name Pool Name
dvwa.f5lab.com dvwa_pool_http
peruggia.f5lab.com peruggia_http_pool
wackopicko.f5lab.com wackopicko_http_pool

Important

  • Estimated completion time: 10 minutes

  1. Open Chrome Browser

  2. Enter https://bigip1 into the address bar and hit Enter

    _images/bigip_login.png
  3. Login with username: admin

    password: admin.F5demo.com

  4. Click Local Traffic -> iRules -> iRules List

  5. Click Create button

    _images/irule_create.png

  6. Enter Name of URI_Routing_iRule

  7. Enter your code

  8. Click Finished

  9. Click Local Traffic -> Virtual Servers -> Virtual Server List

  10. Click on http_irules_vip

    _images/select_vs.png

  11. Click on the Resources tab

  12. Click Manage button for the iRules section

    _images/resources.png

  13. Click on URI_Routing_iRule from the Available box and click the << button, thus moving it to the Enabled box.

    _images/lab1-irules-add.png

  14. Click the Finished button

  15. Open a new tab in Chrome

  16. Enter http://dvwa.f5lab.com/ and ensure you get there

  17. Now enter http://peruggia.f5lab.com/ and ensure you get to the app

  18. Finally, enter http://wackopicko.f5lab.com/ and ensure you can get to that app

    _images/test_sites.png

  19. If you see this image below - it means your iRule did not work.

    _images/it_works.png

Hint

If you need a basic hint here is some example code:

Here is a link to DevCentral: https://clouddocs.f5.com/api/irules/HTTP__host.html

If you are really stuck, here is what we are looking for:

  1. When HTTP_Request comes in
  2. Evaluate the HTTP_host name
  3. If it matches send it to the correct pool.
  4. Loop through all the host names you want to match on and continue to direct to the correct pools.
  5. Now you should have enough to understand and the majority of code needed to create the iRule. If not here is the complete iRule.
Lab 2 - Log and Change Headers

Your iRule should:

  1. Log all HTTP request headers.
  2. Log all HTTP response headers.
  3. Remove the header named Server from all HTTP responses.

Attention

OPTIONAL: Instead of removing the Server header in the response, change the value of the Server header to Microsoft-IIS/7.0.

Important

  • Estimated completion time: 15 minutes

  1. Open Chrome Browser

  2. Enter https://bigip1 into the address bar and hit Enter

    _images/bigip_login.png
  3. Login with username: admin

    password: admin.F5demo.com

  4. Click Local Traffic -> iRules -> iRules List

  5. Click Create button

    _images/irule_create.png

  6. Enter Name of Header_Log_Strip_iRule

  7. Enter Your Code

  8. Click Finished

  9. Click Local Traffic -> Virtual Servers -> Virtual Server List

  10. Click on http_irules_vip

    _images/select_vs.png

  11. Click on the Resources tab

  12. Click Manage button for the iRules section

    _images/resources.png

  13. Click on Header_Log_Strip_iRule from the Available box and click the << button, thus moving it to the Enabled box, your first and now second iRule should be in the Enabled box.

    _images/lab2-irules-add.png

  14. Click the Finished button

  15. Open the Firefox browser

  16. Click the 3 horizontal line button on the far right of the address bar

  17. Use developer tools in Mozilla, or use Chrome to view headers

    _images/firefox_developer.png

  18. Enter http://dvwa.f5lab.com/ and ensure you get there

  19. Now enter http://wackopicko.f5lab.com/

  20. Finally, enter http://peruggia.f5lab.com/ and ensure you can get to that app

  21. Look at the headers for each of your requests. Did you log them all? What is the value of the Server header?

    _images/lab2_verify-remove.png

Attention

OPTIONAL: Instead of removing the Server header in the response, change the value of the Server header to Microsoft-IIS/7.0.

_images/lab2_verify.png

Hint

Basic Hint if you need a hint here is some example code:

Link to DevCentral: https://clouddocs.f5.com/api/irules/HTTP__header.html

If you are really stuck, here is what we are looking for:

  1. When HTTP_Request comes in
  2. Log the headers from the HTTP_REQUEST
  3. When HTTP_RESPONSE comes back
  4. Log the response headers
  5. Now remove the HTTP::header named Server
  6. Now you should have enough to understand and the majority of code to create the iRule. If not here is the complete iRule.
Lab 3 - HTTP to HTTPS Redirect
  1. Create an iRule to redirect all traffic that arrives at an HTTP virtual server to be redirected to the same IP address but using an HTTPS port.
  2. The full original HTTP request should be maintained when re-directing. Example http://my.domain.com/app1/index1.html should redirect to https://my.domain.com/app1/inex.html
  3. Traffic goes to the HTTPS virtual server should still perform the pool selection and should still perform the header stripping from previous labs.

Important

  • Estimated completion time: 20 minutes

  1. Open Chrome Browser

  2. Enter https://bigip1 into the address bar and hit Enter

    _images/bigip_login.png
  3. Login with username: admin

    password: admin.F5demo.com

  4. Click Local Traffic -> iRules -> iRules List

  5. Click Create button

    _images/irule_create.png

  6. Enter Name of HTTP_to_HTTPS_iRule

  7. Enter Your Code

  8. Click Finished

  9. Click Local Traffic -> Virtual Servers -> Virtual Server List

  10. Click on http_irules_vip

    _images/select_vs.png

  11. Click on the Resources tab.

  12. Click Manage button for the iRules section.

    _images/resources.png

  13. Click on HTTP_to_HTTPS_iRule from the Available box and click the << button, thus moving it to the Enabled box, your first, second, and now third iRule’s should be in the Enabled box.

    _images/lab3-irules-add.png

  14. Click the Finished button.

  15. Click Local Traffic -> Virtual Servers -> Virtual Server List.

  16. Click on https_irules_vip

    _images/select_vs_https.png

  17. Click on the Resources tab

  18. Click Manage button for the iRules section

    _images/resources.png

  19. Click on the 2 iRules you require to enable pool selection and Server header removal from the previous labs from the Available box and click the << button, thus moving them to the Enabled box.

    _images/lab3-irules-add-https.png

  20. Enter http://dvwa.f5lab.com/ and ensure you get redirected to the HTTPS virtual server.

  21. Now enter http://wackopicko.f5lab.com/ and ensure you get redirected to the HTTPS virtual server.

  22. Finally, enter http://peruggia.f5lab.com/ ensure you get redirected to the HTTPS virtual server.

    _images/lab3_verify.png

  23. From the previous lab the next two tests should confirm everything is working as before, but using HTTPS.

  24. Look at the headers for each of your requests. Did you log them all? What is the value of the Server header?

    _images/lab2_verify-remove.png

Attention

OPTIONAL: Instead of removing the Server header in the response, change the value of the Server header to Microsoft-IIS/7.0.

_images/lab2_verify.png

Hint

Basic Hint if you need a hint here is some example code:

Link to DevCentral: https://clouddocs.f5.com/api/irules/HTTP__redirect.html

If you are really stuck, here is what we are looking for:

  1. When HTTP_Request comes in
  2. Redirect from HTTP to HTTPS
  3. Now you should have enough to understand and the majority of code to create the iRule. If not here is the complete iRule.
Lab 4 - Stream Profile

Create a Stream Profile to change the body of the DVWA site

Important

  • Estimated completion time: 10 minutes

  1. Open Chrome Browser

  2. Enter https://bigip1 into the address bar and hit Enter

    _images/bigip_login.png
    1. Login with username: admin
      password: admin.F5demo.com

  4. Click Local Traffic -> iRules -> iRules List

  5. Click Create button

    _images/irule_create.png

  6. Enter Name of Stream_iRule

  7. Enter Your Code

  8. Click Finished

  9. Click Local Traffic -> Virtual Servers -> Virtual Server List

  10. Click on https_irules_vip

    _images/select_vs_https.png

  11. In the Configuration section ensure it says Advanced in the drop down

  12. Go to the Stream Profile section and select stream

    _images/advanced-stream.png

  13. Scroll to the bottom and click the Update button

  14. Click on the Resources tab at the top of the page.

  15. Click Manage button for the iRules section

    _images/resources.png

  16. Click on Stream_iRule from the Available box and click the << button, thus moving it to the Enabled box, your first and now second iRule should be in the Enabled box.

    _images/manage_irule.png

  17. Click the Finished button

  18. Open the Firefox browser

  19. Enter https://dvwa.f5lab.com and ensure you get there and it is HTTPS and that the word Damn is replaced with Darn

Hint

Basic Hint if you need a hint here is some example code:

Link to DevCentral: https://clouddocs.f5.com/api/irules/STREAM.html

If you are really stuck, here is what we are looking for:

  1. When HTTP_Request comes in
  2. Second we need to disable both encoding the stream profile for the request
  3. When HTTP_RESPONSE comes back
  4. Next we need to change our stream matching string and turn on the stream profile again.
  5. Now you should have enough to understand and the majority of code to create the iRule. If not here is the complete iRule.
Lab 5 - HTTP Payload Manipulation

Collect an HTTP payload, change it, and release it to the client. As in the previous lab replace Damn with Darn, or get creative. We arent going to use a stream profile this time we are using an HTTP::payload command instead.

Important

  • Estimated completion time: 20 minutes

  1. Open Chrome Browser

  2. Enter https://bigip1 into the address bar and hit Enter

    _images/bigip_login.png
    1. Login with username: admin
      password: admin.F5demo.com

  4. Click Local Traffic -> iRules -> iRules List

  5. Click Create button

    _images/irule_create.png

  6. Click Create button

  7. Enter Name of HTTP_Payload_iRule

  8. Enter Your Code

  9. Click Finished

  10. Click Local Traffic -> Virtual Servers -> Virtual Server List

  11. Click on http_irules_vip

    _images/select_vs.png

  12. Click on the Resources tab.

  13. Click Manage button for the iRules section.

    _images/resources.png

  14. What should you do here? (Hint: Remove Stream_iRule and replace with HTTP_Payload_iRule)

  15. Click the Finished button

  16. Open the Firefox browser

  17. Enter https://dvwa.f5lab.com and ensure you get there and it is HTTPS

Hint

Basic Hint

if you need a hint here is some example code:

Link to DevCentral: https://clouddocs.f5.com/api/irules/HTTP__collect.html

Link to DevCentral: https://clouddocs.f5.com/api/irules/HTTP__release.html

If you are really stuck, here is what we are looking for:

  1. When HTTP_Request comes in
  2. Second change the version of HTTP and disable compression for the request
  3. When HTTP_RESPONSE comes back
  4. Next we need to collect some HTTP::collect some data.
  5. Now when we get HTTP_RESPONSE_DATA
  6. Now we will set some find and replace strings.
  7. Finally we will perform a regsub on the payload and replace with new text.
  8. Now you should have enough to understand and the majority of code to create the iRule. If not here is the complete iRule.
iRules Summary
Here is a summary of all the irules used in this lab
Lab 1 - Complete iRule
Completed iRule 
# if / elseif version

when HTTP_REQUEST {
        if {[HTTP::host] equals "dvwa.f5lab.com"} {
                pool dvwa_pool_http
        } elseif {[HTTP::host] equals "peruggia.f5lab.com"} {
                pool peruggia_http_pool
        } elseif {[HTTP::host] equals "wackopicko.f5lab.com"} {
                pool wackopicko_http_pool
        }
}

# switch version

when HTTP_REQUEST {
        switch [HTTP::host] {
                dvwa.f5lab.com { pool dvwa_pool_http }
                peruggia.f5lab.com { pool peruggia_http_pool }
                wackopicko.f5lab.com { pool wackopicko_http_pool }
        }
}


# Advanced, data group lookup version!

when HTTP_REQUEST {
        if { [class match [HTTP::host] equals "hostnames_dg"] } {
                pool [class lookup [HTTP::host] "hostnames_dg"]
        }
}
Lab 2 - Complete iRule
Completed iRule 
# Header_Strip_Log_iRule

when HTTP_REQUEST {
        log local0. "Request Headers: [HTTP::header names]"
}

when HTTP_RESPONSE {
        log local0. "Response Headers: [HTTP::header names]"
        HTTP::header remove Server
}

# Advanced - Bonus and prettier

when HTTP_REQUEST {
        foreach header [HTTP::header names] {
                log local0. "Request Header $header: [HTTP::header $header]"
        }
}

when HTTP_RESPONSE {
        foreach header [HTTP::header names] {
                log local0. "Response Header $header: [HTTP::header $header]"
                if {$header equals "Server"} {
                        HTTP::header remove $header
                }
        }
        HTTP::header insert Server "Microsoft-IIS/8.0"
}
Lab 3 - Complete iRule
Completed iRule 
# HTTP_to_HTTPS_iRule

when HTTP_REQUEST {
        HTTP::redirect "https://[HTTP::host][HTTP::uri]"
}

# Factory F5 https redirect iRule

when HTTP_REQUEST {
        HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
}
Lab 4 - Complete iRule
Completed iRule 
# Stream_iRule

when HTTP_REQUEST {
        HTTP::header remove Accept-Encoding
        STREAM::disable
}

when HTTP_RESPONSE {
        STREAM::expression @Damn@Darn@
        STREAM::enable
}
Lab 5 - Complete iRule
Completed iRule 
# HTTP_Payload_iRule

when HTTP_REQUEST {
        HTTP::version 1.0
        HTTP::header remove Accept-Encoding
}

when HTTP_RESPONSE {
        HTTP::collect [expr 1024*1024]
}

when HTTP_RESPONSE_DATA {
  set find "Damn"
  set replace "***"

  if {[regsub -all $find [HTTP::payload] $replace new_response] > 0} {
    HTTP::payload replace 0 [HTTP::payload length] $new_response
  }
}
iRules Events
iRules HTTP Events
iRules HTTPS Events