/32 IPs in Datagroup class match not matching
Hello everyone,
maybe someone had a similar issue before and can guide me in the right direction as I can't find anything regarding this on the whole of the internet.
Lets assume a simple iRule, I stripped out a lot of irrelevant things for readability.
when HTTP_REQUEST {
switch -glob -- [string tolower [HTTP::host]] {
"example.org" {
set ha_pool "my-pool"
switch -glob -- [string tolower [HTTP::path]] {
"/" {
# ...
}
"/securestats" {
if { ([class match [IP::client_addr] equals ipv4_monitoring]) or ([class match [IP::client_addr] equals ipv6_monitoring]) } {
set members [active_members -list $ha_pool]
HTTP::respond 200 content $members
} else {
HTTP::respond 403 content {<html>403 Unauthorized</html>}
}
}
}
}
# ...
}
}
The data group looks like this:
ipv4_monitoring:
- 198.51.100.0/24
- 203.0.113.2/32
When a request now hits the if containing the class matches on the two data groups something strange happens.
198.51.100.1 matches and gets the HTTP::respond 200
203.0.113.2 does not match and therefore gets the HTTP::respond 403
IPs and Names in the iRule have been changed to nonsensical but coherent values
Thanks to the suggestion of using a external data group by we did dig in to this again.
Before going into how we solved this I just want to say that we are going to look into filing a issue about this and some of my technical understanding of the cause may be flawed.
The root of the issue lies expression:
[class match [IP::client_addr] equals ipv4_monitoring]
The internal datagroup ipv4_monitoring was created with this content:
- 198.51.100.0/24
- 203.0.113.2/32
And, looking at bigip.conf, we can verify that this gets persisted into configuration.
But, whatever we add with /32 it will not match -> This is where we will look into filing a issue with F5, I will update this thread as applicable.
Now we remove and recreate the data group using a external data group containing this:
network 198.51.100.0/24, host 203.0.113.2,
And now we get a match in the expression in question and can live happily ever after