- Pulse Secure Community
- :
- About sameh
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
03-26-2013
02-12-2021
sameh
Contributor
40
Posts
10
Kudos
4
Solutions
02-01-2016
06:46:AM
1 Kudo
You are testing for a string match: if ( $ip == $allowedIPs[$i]) This works for an IP but not for a subnet. TrafficScript offers a function to test an IP presence in a subnet: string.ipmaskmatch($ip, $subnet) And you can use a simple foreach to test the array until a match is found like in this subroutine: sub IPorSubnetMatch($networksAndIPs, $ip) {
foreach ($subnetOrIP in $networksAndIPs) {
if (string.ipmaskmatch($ip, $subnetOrIP)) {
return (1==1);
}
}
return(1!=1);
} (I was not sure if boolean is a real type in TS) Another problem - might not be relevant since you edited that part of the code - is that you redirect to https://blah.com/rdweb if Host: starts with "blah.com" which sounds like a redirect loop to me :) To wrap it up and because you don't want to test the requested path on each IP test, you should use the aforementionned function and reduce your code to something like if( string.startsWithI( http.getHostHeader(), “blah.com”)) {
$path = http.getPath();
if(string.containsI( $path, "/RDWeb" ) || string.containsI ( $path, "/rpc" ) || string.containsI( $path, "/remoteDesktopGateway" )) {
$allowedIPs = [ "123.123.0.1","109.233.52.0/24"];
$ip = request.getRemoteIP();
if (IPorSubnetMatch($allowedIPs, $ip)) {
pool.use( "Blah_RDS" );
} else {
connection.discard();
}
}
} else {
http.redirect( "https://notblah.com/rdweb" );
}
... View more
01-15-2016
06:32:AM
In an authenticator configuration: Whether or not to enable SSL encryption to the LDAP server.
ldap!ssl: Yes / No
The type of LDAP SSL encryption to use.
ldap!ssl!type: LDAPS / Start TLS
... View more
01-05-2016
11:32:AM
In a previous post I was offered to share my TS code to achieve a consistently hashed load balancing. DISCLAIMER: I am definitely not a developer, this code is ugly, naive, shy and I am pretty sure there are off-by-one errors imbalancing the share of requests each node will receive, feel free to debug them, but I'm too lazy to do it now it works decently :) So don't judge me too hard: you can laugh at the code, but please make sure I can't hear you. Obviously it would be much better if handled internally as one of the current load balancing algorithms, but it still isn't, and I believe this feature is very helpful, so here I post it. An archetypical scenario: when vTM is running in front of a bunch of caching servers. You will probably want to optimize your caching surface by not fragmenting it, e.g. by sending 2 identical requests to the same server. This could apply to a lesser extent to dynamic backends, That's where consistent hashes come handy: they can balance requests equally (not accurately here, see disclaimer) among a pool of nodes and have the awesome property to only rebalance 1/n of the traffic when a node comes down (where n = pool size). Read more about them here. Not going through details, the code is pretty straightforward and written naively, following general chash principles. One library. One rule to call it. The CHashLib: # blame sameh
sub abs ($num) {
if ($num < 0) {
return (-$num);
} else {
return ($num);
}
}
sub haHash($str) {
# Cheap but enough I guess
return (abs(string.bytesToInt(string.substring(string.hashMD5($str), 0, 3))));
}
sub buildCHashRing($pool) { #builds the in-memory ring
# **filtered** Feel free to update those arbitrary numbers to your needs depending on your SLAs
$delayBeforeRefresh = 10 + math.random(14); # refresh the ring every 10-23 seconds pe
$nbReplicas = 10; # how many entries on ring per node in pool
$lastUpdate = data.get($pool . "_lastRingUpdate");
if ($lastUpdate == "") { $lastUpdate = 0; }
$currentTime = sys.time();
if ($lastUpdate + $delayBeforeRefresh < $currentTime) { # Time to refresh!
data.set($pool . "_lastRingUpdate", $currentTime); # Mark the ring as updated + is a way to reserve the computing slot when concurrent checks occur
$ring = [];
$indexList = [];
foreach ($node in pool.listactivenodes($pool)) { # Very important to notice when a failed node comes back up (i.e. active health checking is MANDATORY)
for ($replica=0; $replica < $nbReplicas; $replica++) {
$hashedIndex = haHash($node . "_" . $replica);
$ring[$hashedIndex] = $node;
array.push($indexList, $hashedIndex);
}
}
array.sortNumerical($indexList);
data.set($pool . "_CHashRing", $ring);
data.set($pool . "_indexList", $indexList);
return ($ring);
} else {
return (data.get($pool . "_CHashRing"));
}
}
# returns the name of the node we want to use according to haHash($str)
sub getNodeFromRing($pool, $str) { # pool name and string to hash for match (beginning of URIs as of now)
# shall we buildCHashRing from here? probably smarter to do it from rule in case we query multiple times
buildCHashRing($pool);
$searchedHash = haHash($str);
$indexList = data.get($pool . "_indexList");
if (!lang.isArray($indexList) || array.length($indexList) < 1) { return (""); }
$currentIndex = array.shift($indexList);
$electedIndex = $currentIndex;
while (array.length($indexList) > 0 && $searchedHash > $currentIndex) {
$electedIndex = $currentIndex;
$currentIndex = array.shift($indexList);
}
if (array.length($indexList) == 0 && $searchedHash > $currentIndex) { # fin du ring
$electedIndex = $currentIndex;
}
return (data.get($pool . "_CHashRing")[$electedIndex]);
}
# load balances a request if the elected node is alive, else let ZXTM fallback to regular load balancing
sub poolSelectFromRing($pool, $str) {
$node = getNodeFromRing($pool, $str);
if ($node != "" && array.contains(pool.listactivenodes($pool), $node)) {
$node = string.split($node, ":");
pool.select($pool, $node[0], $node[1]);
} else {
pool.select($pool);
}
} A request rule calling the library to balance a request according to arbitrary criterias: # blame sameh
import CHashLib;
# Hash considering only the first 4 characters in the URI
CHashLib.poolSelectFromRing("poolname", string.left(http.getPath(), 4)); Hope this helps, have fun!
... View more
12-16-2015
06:39:AM
Indeed that sounds quite tricky. To avoid using a trafficscript rule, I would rather use zcli and VirtualServer.setRules. If a rule is mandatory but you don't want to do a synchronous call that could block, an option could be to have a rule raise an event, which would trigger an action running an external program doing the REST API call to toggle another rule's attributes. But we're digging deeper the pit of inelegance here, if you provide more background maybe we could think of a better solution?
... View more
12-08-2015
06:18:AM
Hello, I am migrating from 9.9 to 10.2. One of the changes is reported by this warning message about some of my rules: "Use of connection.close is deprecated for HTTP virtual servers. Use http.sendResponse with http.disableClientKeepalive instead." I understand the reasons behind this change. But I use "Extra Files" to set a custom error page for a Virtual Server. Those error pages have to embed the HTTP status banner and the response headers. Then comes the body. Because of this file format, it makes it pretty handy to use connection.close(resource.get($extra_file)); To answer in HTTP the same way we would have in case of errors. Now if I want to do the same with http.disableClientKeepalive() + http.sendResponse(), I will have to split HTTP banner, response headers, and body, which is a bit unoptimized even if I can store the result in memory (data.set()/data.get()). What would you advise people to do rather than parse the file content or send a redundant extra file that would exclude headers? Cheers, Sameh
... View more
11-25-2015
02:32:AM
I would require more info about your setup especially network topology. If you want to leverage vTM power, you need to not do DSR because vTM is a layer 7 load balancer, handling client connections and multiplexing them over its own connections to your backends. When DSR is useful, it usually means you can just forget about vTM because you need a simple router, not a layer 7 load balancer. vTM can handle TCP traffic but what do you mean by redirection? Basically vTM is going to act as a TCP server and forward traffic to another TCP server, see protocols "Generic client first", "Generic server first" and "Generic streaming server".
... View more
11-23-2015
05:26:AM
Are you sure you need DSR? I don't see how it would help servers communicate with each others directly.
... View more
03-30-2015
06:44:AM
Are you talking about the "slowloris" DoS? Slowloris (software) - Wikipedia, the free encyclopedia If so, it should not affect the backend servers since STM will buffer the request before passing it to the backend. Whenever under attack, check first if you can find a simple pattern: same request header, same originating IP, same URI, that you would be able to block before it causes ressource starvation.
... View more
03-05-2015
06:27:AM
Do you need to script it? If you don't, the Config Summary page might do the trick: /apps/zxtm/index.fcgi?section=Config%20Summary If you do, I would use zcli and those commands: [email protected] > VirtualServer.getVirtualServerNames [ VS1, VS2 ] [email protected] > VirtualServer.getRules "VS1" [ { enabled: 1, name: "SECURITY - Block TRACE+TRACK requests", run_frequency: only_first }, { enabled: 1, name: "VS1 Rule", run_frequency: only_first } ] [email protected] > VirtualServer.getRules "VS2" [ { enabled: 1, name: "SECURITY - Block TRACE+TRACK requests", run_frequency: only_first }, { enabled: 1, name: "VS2 Rule", run_frequency: only_first } ]
... View more
03-05-2015
01:50:AM
Thank you for your answer Aidan. Actually I cannot reproduce those issues when I use a fresh configuration designed to exhibit this behavior. I thought I had looked at all caveats already but it seems I should dig further! I will get back here once I find the ugly truth about my rules!
... View more
02-27-2015
07:25:AM
It seems there are odd cases where changing the Host header is silently not allowed. I found at least two places where I could NOT change this header before STM forwards a request to a backend: * http.request.head(url, [ headers ], [ timeout ]) (and I suppose http.request.get()) do not accept a Host header in the optional "headers" argument. This can be a real problem since I guess people use it to craft custom requests. * http.setHeader("Host", "hostheader") does not rewrite the Host header when it happens in a Request rule of an SSL Decrypting Virtual Server. Not sure why those limitations. Can someone confirm the problem? Will this be allowed in the future? There are ways to circumvent the issue but it's not as elegant. Cheers, Sameh.
... View more
11-24-2014
11:35:AM
Is there a way to publicly track enhancement requests?
... View more
10-26-2014
07:24:AM
You want to use another reverse proxy server. It will connect to your actual origin, and you will use it as your ZXTM pool.
... View more
10-20-2014
10:50:AM
You're right, it works! Awesome! I don't know why I had error messages in the first place, maybe because my http.request.* TS rule was being used by both the UDP Virtual Server AND an HTTP VS, at the transaction completion time (which is prohibited)? I am happy to see I am not the only one to mix session and session-less protocols, it is a relief for my karma . Cheers, Sameh. PS: Maybe we should document an example of async2sync, this kind of feature is not (well) implemented on open-source load balancing software, and it can prove handy in quite a lot of situations. For instance one could support stale-while-revalidate cache control extension semantics RFC 5861 - HTTP Cache-Control Extensions for Stale Content using this.
... View more
10-17-2014
08:49:AM
Hello, I have been trying to start asynchronous tasks from my STM 9.6. For instance, to create HTTP "duplicate" requests. Let's say a client C contacts load balancer L with request R to talk to server S. I want L to be able to route R to S. And *then* trigger another HTTP request R', sent to S'. With no penalty for C. This is something easy to do in TrafficScript using http.request.* commands. Unfortunately, if I add it in a Response Rule, it will delay the answer to C. I was happy Transaction Completion Rules were introduced because I believed it would fit perfectly. Sadly, after some failed attempts and a look at 9.8 documentation, I found out http.request.* were forbidden at this stage of the processing. So, I thought about a painfully ugly solution: using custom events emitted at the Transaction Completion time to trigger a UDP syslog packet sent to a local Virtual Server. This VS would be sitting on an UDP socket and parsing the content of incoming segments to tell what request R' to send to S'. That's when I found out I cannot use http.request.*, even in a Request Rule, if I run a UDP VS... I am surprised TrafficScript "client" features are that much tied to the protocol of the VS. Now I know some tools exist to do what I want ( buger/gor · GitHub ) but I really enjoyed the idea of doing it 100% at the STM level. Any idea that does not involve Java or log tailing? Cheers, Sameh.
... View more
09-11-2014
05:08:AM
1 Kudo
Hehe, no problem: #specific addresses $allowed = [ "192.168.1.68", "10.0.0.43", "172.16.1.177", "8.8.8.8" ]; if( ! array.contains( $allowed, request.getRemoteIP() ) { connection.discard(); } Should read: #specific addresses $allowed = [ "192.168.1.68", "10.0.0.43", "172.16.1.177", "8.8.8.8" ]; if( ! array.contains( $allowed, request.getRemoteIP() ) ) { connection.discard(); }
... View more
09-11-2014
02:53:AM
1 Kudo
The second conditional statement lacks a closing parenthesis. Cheers
... View more
09-10-2014
01:42:AM
Hello Stephane, I never played with IP transparency on SteelApp TM, but what about enforcing the restrictions at the LB level? Rate-limiting, ACL to discard connections, etc. I personally don't use load balancing for SMTP and rather rely on another MTA sitting in-between Exchange and Internet. This is because SMTP inbound already includes failover (multiple MX records) and does not require low latency fallbacks. If you are setting up an outbound Exchange SMTP though, I understand why the trouble going with IP transparency. Can you elaborate on the problems you're encountering?
... View more
07-29-2014
01:39:PM
1 Kudo
I agree this is an important and necessary feature. Someone did this:Backup Stingray Configurations to Git Cheers, Sameh
... View more
07-14-2014
07:59:AM
Hi Jochen, How do you handle the case where a request is not resendable and the pool is not seen as 100% failed (some requests fail, some don't)?
... View more
07-09-2014
10:53:AM
EDIT: The problem was related to my /etc/ldap.conf, see Post Scriptum. Hello, I have 4 SteelApp servers A, B, C and D running in a cluster (recently switched to Unicast Heartbeat Method). In order to do an important network change, I took B out of the cluster, changed its network settings (basically IP/VLAN changes) and then tried to put it back using zxtm/configure. It failed to replicate the configuration from member A, but B was appearing in the Traffic Managers list (using UI running on A, C or D). I had to remove B again from the cluster (otherwise it was complaining the cluster was already full: 4 nodes, when I tried to join) and I decided to install SteelApp again from scratch on B (zinstall). This time it went worse: A decided to delete all its configuration (including the users..). So now I have only C and D running correctly, A and B have no settings anymore. I tried from scratch to have A join the cluster, at least this one didn't go under an IP address change. No more luck: "Config Replication Error: replicate-config exited with code 1 and stderr: There was a problem communicating with machine A:9080. This may be because the software is not running. The error was: Write to A failed: Broken pipe." Like if zxtm/configure was trying to replicate locally before the software is fully running? I tried to join the cluster with a new name for A, just in case there were stale entries on C and D, no more luck. Anyway, I can't join the cluster anymore. Any idea what could be the safest way to fix this mess? Cheers! PS Edit: Here is the output for a fresh started cluster. As you can see a daemon is segfaulting on startup. It was probably hidden by the zinstall program: Initializing Riverbed Application Framework. Copyright (C) 2014, Riverbed Technology, Inc. All rights reserved Stingray Admin Server - (C) 2014, Riverbed Technology, Inc. All rights reserved. Version 9.6r1, Build date: Apr 10 2014 10:22:20 INFO Stingray Admin Server started INFO Version 9.6r1, Build date: Apr 10 2014 10:22:20 INFO https://node_A:9090 INFO Stingray Admin Server running Stingray Traffic Manager - Copyright (C) 1995 - 2014, Riverbed Technology, Inc. All rights reserved. Version 9.6r1, Build date: Apr 10 2014 10:15:55 INFO Control connection privileges unrestricted zeus.zxtm: sbind.c:71: ldap_simple_bind: Assertion `( (ld)->ldc->ldc_options.ldo_valid == 0x2 )' failed. Aborted (core dumped) REST API disabled After moving the UNIX user name running SteelApp to the nss_initgroups_ignoreusers list of the /etc/ldap.conf, SteelApp starts fine and I was able to put A and B back in the cluster!
... View more
07-09-2014
07:56:AM
Then instead of using a maintenance page per pool, use a page per application? The most important documentation is Sending custom error pages You can adapt it to your scenario. You can also duplicate pools to have one per application. Hope this helps.
... View more
07-07-2014
07:09:PM
1 Kudo
Hello Rajesh, There are different ways to do this. In your scenario, I think a solution could be Sending custom error pages Let's adapt it to your situation (one per pool). Create 1 new Virtual Server/Traffic IP Group that will be used as the Failure Pool for all the pools your VS is using. This VS will use "discard" as Default Pool. Upload all your different maintenance pages to the Extra Files Catalog, in the Miscellaneous section. If you name your pages like "maintenancepage_<poolName>.html" you could then import the same pool routing logic as your production VS to serve the right Failure Pool maintenance page. Have a look at Sending custom error pages, it holds a clear explanation of the process, especially if you need to embed files from your maintenance pages. If we consider your current pool routing to look like: if (condition A) { pool.use("foo"); } else if (condition B) { pool.use("bar"); } ... else { # Default pool } You could just translate it to: if (condition A) { $pool="foo"; } else if (condition B) { $pool="bar"; } ... else { $pool="default"; # to match the default maintenance page file name } And add some logic to serve the specific pages, as instructed how here: Sending custom error pages Just make sure to use resource.get("maintenancepage_" . $pool . ".html"); instead. I also would advise people to use another response code than 200, because the client should be able to know not everything went well, even if it is eye candy.
... View more
06-20-2014
09:29:AM
I have a cluster of 4 SteelApp Traffic Managers that has always been using multicast communication for heartbeats between TMs. I want to do big network changes that will make multicast temporarily unavailable. Because of this, I plan to fully switch the cluster to unicast communication. At least for the time of the network migration. How does a cluster behave if you switch it to unicast? In case of failure I am mainly worried about a TM unable to communicate with the others, trying to grab all traffic group IP addresses. Is there a way to do this change safely? Maybe disabling temporarily fault tolerance?
... View more
05-19-2014
08:56:AM
Splitting by IP address is the way to go if you have clients not supporting SNI and the domains are different (i.e. you can't use SSL wildcards): Server Name Indication - Wikipedia, the free encyclopedia Fortunately you can map IP addresses to SSL certificates at the Virtual Server level, you don't need to create two different Traffic IP groups.
... View more
05-16-2014
01:25:AM
No, setPath() only affects the request. That is why you might have to do the inverse search and replace on the response, headers or body if your application needs it.
... View more
05-15-2014
01:40:AM
1 Kudo
http.setPath() only rewrites the first line of the request before it is sent to the backends. If the browser is aware of this, it means the backend does something more, for instance sending HTTP 301/302 redirects.
... View more
05-14-2014
05:58:AM
2 Kudos
I don't know mod_proxy so I am not sure what you are trying to achieve, but it looks like you just need to rewrite the URI? Then you should use http.getPath() / http.setPath() combined with string replacement functions. When used in a TS request rule this will rewrite the URI before passing the request to the backend. You don't seem to need regexp here, so this should help, and if it is wrong, at least it should get you closer to the solution $path = http.getPath(); if (string.startsWith($path, "/foobar")) { $path = string.replace($path, "/foobar", "/foo"); } if (string.startsWith($path, "/bar/foo")) { $path = string.replace($path, "/bar", ""); } http.setPath($path);
... View more
05-14-2014
05:23:AM
1 Kudo
Hi Michael, I would have written your rule like this: $path = http.getPath(); if( http.getHostHeader() == "test.com" && string.startsWith($path, "/path1") ){ $path = string.replace( $path, "/path1", "/path2"); http.setPath( $path); pool.use( "pool-1"); } The Host header does not contain the URL scheme, and you have a trailing space character at the end of your "/path1 " string in the condition too. Cheers
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
