diff --git a/lib/ansible/modules/network/f5/bigip_irule.py b/lib/ansible/modules/network/f5/bigip_irule.py index 2f7495cfcc2..17c21486987 100644 --- a/lib/ansible/modules/network/f5/bigip_irule.py +++ b/lib/ansible/modules/network/f5/bigip_irule.py @@ -18,10 +18,11 @@ # You should have received a copy of the GNU General Public License # along with Ansible. If not, see . -ANSIBLE_METADATA = {'metadata_version': '1.0', - 'status': ['preview'], - 'supported_by': 'community'} - +ANSIBLE_METADATA = { + 'status': ['preview'], + 'supported_by': 'community', + 'metadata_version': '1.0' +} DOCUMENTATION = ''' --- @@ -40,28 +41,22 @@ options: module: description: - The BIG-IP module to add the iRule to. - required: true + required: True choices: - ltm - gtm - partition: - description: - - The partition to create the iRule on. - required: false - default: Common name: description: - The name of the iRule. - required: true + required: True src: description: - The iRule file to interpret and upload to the BIG-IP. Either one of C(src) or C(content) must be provided. - required: true + required: True state: description: - Whether the iRule should exist or not. - required: false default: present choices: - present @@ -77,9 +72,9 @@ author: ''' EXAMPLES = ''' -- name: Add the iRule contained in templated irule.tcl to the LTM module +- name: Add the iRule contained in template irule.tcl to the LTM module bigip_irule: - content: "{{ lookup('template', 'irule-template.tcl') }}" + content: "{{ lookup('template', 'irule.tcl') }}" module: "ltm" name: "MyiRule" password: "secret" @@ -94,7 +89,7 @@ EXAMPLES = ''' name: "MyiRule" password: "secret" server: "lb.mydomain.com" - src: "irule-static.tcl" + src: "irule.tcl" state: "present" user: "admin" delegate_to: localhost @@ -111,62 +106,112 @@ src: returned: changed and success, when provided type: string sample: "/opt/src/irules/example1.tcl" -name: - description: The name of the iRule that was managed - returned: changed and success - type: string - sample: "my-irule" content: description: The content of the iRule that was managed returned: changed and success type: string sample: "when LB_FAILED { set wipHost [LB::server addr] }" -partition: - description: The partition in which the iRule was managed - returned: changed and success - type: string - sample: "Common" ''' -try: - from f5.bigip import ManagementRoot - from icontrol.session import iControlUnexpectedHTTPError - HAS_F5SDK = True -except ImportError: - HAS_F5SDK = False - -MODULES = ['gtm', 'ltm'] +from ansible.module_utils.f5_utils import ( + AnsibleF5Client, + AnsibleF5Parameters, + HAS_F5SDK, + F5ModuleError, + iControlUnexpectedHTTPError +) -class BigIpiRule(object): - def __init__(self, *args, **kwargs): - if not HAS_F5SDK: - raise F5ModuleError("The python f5-sdk module is required") +class Parameters(AnsibleF5Parameters): + api_map = { + 'apiAnonymous': 'content' + } - if kwargs['state'] != 'absent': - if not kwargs['content'] and not kwargs['src']: - raise F5ModuleError( - "Either 'content' or 'src' must be provided" - ) + updatables = [ + 'content' + ] - source = kwargs['src'] - if source: - with open(source) as f: - kwargs['content'] = f.read() + api_attributes = [ + 'apiAnonymous' + ] - # The params that change in the module - self.cparams = dict() + returnables = [ + 'content', 'src', 'module' + ] - # Stores the params that are sent to the module - self.params = kwargs - self.api = ManagementRoot(kwargs['server'], - kwargs['user'], - kwargs['password'], - port=kwargs['server_port']) + def to_return(self): + result = {} + try: + for returnable in self.returnables: + result[returnable] = getattr(self, returnable) + result = self._filter_params(result) + except Exception: + pass + return result - def flush(self): + def api_params(self): + result = {} + for api_attribute in self.api_attributes: + if self.api_map is not None and api_attribute in self.api_map: + result[api_attribute] = getattr(self, self.api_map[api_attribute]) + else: + result[api_attribute] = getattr(self, api_attribute) + result = self._filter_params(result) + return result + + @property + def content(self): + if self._values['content'] is None: + return None + return str(self._values['content']).strip() + + @property + def src(self): + if self._values['src'] is None: + return None + return self._values['src'] + + @src.setter + def src(self, value): + if value: + self._values['src'] = value + with open(value) as f: + result = f.read() + self._values['content'] = result + + +class ModuleManager(object): + def __init__(self, client): + self.client = client + + def exec_module(self): + if self.client.module.params['module'] == 'ltm': + manager = self.get_manager('ltm') + elif self.client.module.params['module'] == 'gtm': + manager = self.get_manager('gtm') + else: + raise F5ModuleError( + "An unknown iRule module type was specified" + ) + return manager.exec_module() + + def get_manager(self, type): + if type == 'ltm': + return LtmManager(self.client) + elif type == 'gtm': + return GtmManager(self.client) + + +class BaseManager(object): + def __init__(self, client): + self.client = client + self.want = Parameters(self.client.module.params) + self.changes = Parameters() + + def exec_module(self): + changed = False result = dict() - state = self.params['state'] + state = self.want.state try: if state == "present": @@ -176,214 +221,206 @@ class BigIpiRule(object): except iControlUnexpectedHTTPError as e: raise F5ModuleError(str(e)) - result.update(**self.cparams) + changes = self.changes.to_return() + result.update(**changes) result.update(dict(changed=changed)) return result - def read(self): - """Read information and transform it + def _set_changed_options(self): + changed = {} + for key in Parameters.returnables: + if getattr(self.want, key) is not None: + changed[key] = getattr(self.want, key) + if changed: + self.changes = Parameters(changed) - The values that are returned by BIG-IP in the f5-sdk can have encoding - attached to them as well as be completely missing in some cases. - - Therefore, this method will transform the data from the BIG-IP into a - format that is more easily consumable by the rest of the class and the - parameters that are supported by the module. - """ - p = dict() - name = self.params['name'] - partition = self.params['partition'] - module = self.params['module'] - - if module == 'ltm': - r = self.api.tm.ltm.rules.rule.load( - name=name, - partition=partition - ) - elif module == 'gtm': - r = self.api.tm.gtm.rules.rule.load( - name=name, - partition=partition - ) - - if hasattr(r, 'apiAnonymous'): - p['content'] = str(r.apiAnonymous.strip()) - p['name'] = name - return p - - def delete(self): - params = dict() - check_mode = self.params['check_mode'] - module = self.params['module'] - - params['name'] = self.params['name'] - params['partition'] = self.params['partition'] - - self.cparams = camel_dict_to_snake_dict(params) - if check_mode: + def _update_changed_options(self): + changed = {} + for key in Parameters.updatables: + if getattr(self.want, key) is not None: + attr1 = getattr(self.want, key) + attr2 = getattr(self.have, key) + if attr1 != attr2: + changed[key] = attr1 + if changed: + self.changes = Parameters(changed) return True - - if module == 'ltm': - r = self.api.tm.ltm.rules.rule.load(**params) - r.delete() - elif module == 'gtm': - r = self.api.tm.gtm.rules.rule.load(**params) - r.delete() - - if self.exists(): - raise F5ModuleError("Failed to delete the iRule") - return True - - def exists(self): - name = self.params['name'] - partition = self.params['partition'] - module = self.params['module'] - - if module == 'ltm': - return self.api.tm.ltm.rules.rule.exists( - name=name, - partition=partition - ) - elif module == 'gtm': - return self.api.tm.gtm.rules.rule.exists( - name=name, - partition=partition - ) + return False def present(self): + if not self.want.content and not self.want.src: + raise F5ModuleError( + "Either 'content' or 'src' must be provided" + ) if self.exists(): return self.update() else: return self.create() - def update(self): - params = dict() - current = self.read() - changed = False - - check_mode = self.params['check_mode'] - content = self.params['content'] - name = self.params['name'] - partition = self.params['partition'] - module = self.params['module'] - - if content is not None: - content = content.strip() - if 'content' in current: - if content != current['content']: - params['apiAnonymous'] = content - else: - params['apiAnonymous'] = content - - if params: - changed = True - params['name'] = name - params['partition'] = partition - self.cparams = camel_dict_to_snake_dict(params) - if 'api_anonymous' in self.cparams: - self.cparams['content'] = self.cparams.pop('api_anonymous') - if self.params['src']: - self.cparams['src'] = self.params['src'] - - if check_mode: - return changed - else: - return changed - - if module == 'ltm': - d = self.api.tm.ltm.rules.rule.load( - name=name, - partition=partition - ) - d.update(**params) - d.refresh() - elif module == 'gtm': - d = self.api.tm.gtm.rules.rule.load( - name=name, - partition=partition - ) - d.update(**params) - d.refresh() - - return True - def create(self): - params = dict() - - check_mode = self.params['check_mode'] - content = self.params['content'] - name = self.params['name'] - partition = self.params['partition'] - module = self.params['module'] - - if check_mode: + self._set_changed_options() + if self.client.check_mode: return True - - if content is not None: - params['apiAnonymous'] = content.strip() - - params['name'] = name - params['partition'] = partition - - self.cparams = camel_dict_to_snake_dict(params) - if 'api_anonymous' in self.cparams: - self.cparams['content'] = self.cparams.pop('api_anonymous') - if self.params['src']: - self.cparams['src'] = self.params['src'] - - if check_mode: - return True - - if module == 'ltm': - d = self.api.tm.ltm.rules.rule - d.create(**params) - elif module == 'gtm': - d = self.api.tm.gtm.rules.rule - d.create(**params) - + self.create_on_device() if not self.exists(): raise F5ModuleError("Failed to create the iRule") return True + def should_update(self): + result = self._update_changed_options() + if result: + return True + return False + + def update(self): + self.have = self.read_current_from_device() + if not self.should_update(): + return False + if self.client.check_mode: + return True + self.update_on_device() + return True + def absent(self): - changed = False - if self.exists(): - changed = self.delete() + return self.remove() + return False - return changed + def remove(self): + if self.client.check_mode: + return True + self.remove_from_device() + if self.exists(): + raise F5ModuleError("Failed to delete the iRule") + return True + + +class LtmManager(BaseManager): + def exists(self): + result = self.client.api.tm.ltm.rules.rule.exists( + name=self.want.name, + partition=self.want.partition + ) + return result + + def update_on_device(self): + params = self.want.api_params() + resource = self.client.api.tm.ltm.rules.rule.load( + name=self.want.name, + partition=self.want.partition + ) + resource.update(**params) + + def create_on_device(self): + params = self.want.api_params() + resource = self.client.api.tm.ltm.rules.rule + resource.create( + name=self.want.name, + partition=self.want.partition, + **params + ) + + def read_current_from_device(self): + resource = self.client.api.tm.ltm.rules.rule.load( + name=self.want.name, + partition=self.want.partition + ) + result = resource.attrs + return Parameters(result) + + def remove_from_device(self): + resource = self.client.api.tm.ltm.rules.rule.load( + name=self.want.name, + partition=self.want.partition + ) + resource.delete() + + +class GtmManager(BaseManager): + def read_current_from_device(self): + resource = self.client.api.tm.gtm.rules.rule.load( + name=self.want.name, + partition=self.want.partition + ) + result = resource.attrs + return Parameters(result) + + def remove_from_device(self): + resource = self.client.api.tm.gtm.rules.rule.load( + name=self.want.name, + partition=self.want.partition + ) + resource.delete() + + def exists(self): + result = self.client.api.tm.gtm.rules.rule.exists( + name=self.want.name, + partition=self.want.partition + ) + return result + + def update_on_device(self): + params = self.want.api_params() + resource = self.client.api.tm.gtm.rules.rule.load( + name=self.want.name, + partition=self.want.partition + ) + resource.update(**params) + + def create_on_device(self): + params = self.want.api_params() + resource = self.client.api.tm.gtm.rules.rule + resource.create( + name=self.want.name, + partition=self.want.partition, + **params + ) + + +class ArgumentSpec(object): + def __init__(self): + self.supports_check_mode = True + self.argument_spec = dict( + content=dict( + required=False, + default=None + ), + src=dict( + required=False, + default=None + ), + name=dict(required=True), + module=dict( + required=True, + choices=['gtm', 'ltm'] + ) + ) + self.mutually_exclusive = [ + ['content', 'src'] + ] + self.f5_product_name = 'bigip' def main(): - argument_spec = f5_argument_spec() + if not HAS_F5SDK: + raise F5ModuleError("The python f5-sdk module is required") - meta_args = dict( - content=dict(required=False, default=None), - src=dict(required=False, default=None), - name=dict(required=True), - module=dict(required=True, choices=MODULES) - ) - argument_spec.update(meta_args) + spec = ArgumentSpec() - module = AnsibleModule( - argument_spec=argument_spec, - supports_check_mode=True, - mutually_exclusive=[ - ['content', 'src'] - ] + client = AnsibleF5Client( + argument_spec=spec.argument_spec, + mutually_exclusive=spec.mutually_exclusive, + supports_check_mode=spec.supports_check_mode, + f5_product_name=spec.f5_product_name ) try: - obj = BigIpiRule(check_mode=module.check_mode, **module.params) - result = obj.flush() - - module.exit_json(**result) + mm = ModuleManager(client) + results = mm.exec_module() + client.module.exit_json(**results) except F5ModuleError as e: - module.fail_json(msg=str(e)) + client.module.fail_json(msg=str(e)) -from ansible.module_utils.basic import * -from ansible.module_utils.ec2 import camel_dict_to_snake_dict -from ansible.module_utils.f5_utils import * if __name__ == '__main__': main() diff --git a/test/units/modules/network/f5/fixtures/create_gtm_irule.tcl b/test/units/modules/network/f5/fixtures/create_gtm_irule.tcl new file mode 100644 index 00000000000..d2283646c5a --- /dev/null +++ b/test/units/modules/network/f5/fixtures/create_gtm_irule.tcl @@ -0,0 +1,8 @@ +when LB_SELECTED { + # Capture IP address chosen by WIP load balancing + set wipHost [LB::server addr] +} + +when LB_FAILED { + set wipHost [LB::server addr] +} diff --git a/test/units/modules/network/f5/fixtures/create_ltm_irule.tcl b/test/units/modules/network/f5/fixtures/create_ltm_irule.tcl new file mode 100644 index 00000000000..5f7624a33f1 --- /dev/null +++ b/test/units/modules/network/f5/fixtures/create_ltm_irule.tcl @@ -0,0 +1,18 @@ +when RULE_INIT { + set static::FormBaseURL "/sp-ofba-form" + set static::FormReturnURL "/sp-ofba-completed" + set static::HeadAuthReq "X-FORMS_BASED_AUTH_REQUIRED" + set static::HeadAuthRet "X-FORMS_BASED_AUTH_RETURN_URL" + set static::HeadAuthSize "X-FORMS_BASED_AUTH_DIALOG_SIZE" + set static::HeadAuthSizeVal "800x600" + set static::ckname "MRHSession_SP" + set static::Basic_Realm_Text "SharePoint Authentication" +} + +when HTTP_REQUEST { + set apmsessionid [HTTP::cookie value MRHSession] +} + +when HTTP_RESPONSE { + # Insert persistent cookie for html content type and private session +} diff --git a/test/units/modules/network/f5/fixtures/load_gtm_irules.json b/test/units/modules/network/f5/fixtures/load_gtm_irules.json new file mode 100644 index 00000000000..7ca9da1bf7a --- /dev/null +++ b/test/units/modules/network/f5/fixtures/load_gtm_irules.json @@ -0,0 +1,20 @@ +[ + { + "kind": "tm:gtm:rule:rulestate", + "name": "asdf", + "partition": "Common", + "fullPath": "/Common/asdf", + "generation": 92, + "selfLink": "https://localhost/mgmt/tm/gtm/rule/~Common~asdf?ver=12.1.2", + "apiAnonymous": "when DNS_REQUEST {\n if { [IP::addr [IP::remote_addr] equals 10.254.254.0/24] } {\n cname test.affilate.example.com\n\n } elseif { [IP::addr [IP::remote_addr] equals 10.0.0.0/8] } {\n cname test.internal.example.com\n\n }\n #everything else will be handled by the default pools in the main WIP\n}" + }, + { + "kind": "tm:gtm:rule:rulestate", + "name": "foo", + "partition": "Common", + "fullPath": "/Common/foo", + "generation": 93, + "selfLink": "https://localhost/mgmt/tm/gtm/rule/~Common~foo?ver=12.1.2", + "apiAnonymous": "when LB_SELECTED {\n # Capture IP address chosen by WIP load balancing\n set wipHost [LB::server addr]\n}\n\nwhen LB_FAILED {\n set wipHost [LB::server addr]\n}" + } + ] diff --git a/test/units/modules/network/f5/fixtures/load_ltm_irules.json b/test/units/modules/network/f5/fixtures/load_ltm_irules.json new file mode 100644 index 00000000000..b3e026a120b --- /dev/null +++ b/test/units/modules/network/f5/fixtures/load_ltm_irules.json @@ -0,0 +1,179 @@ +[ + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_APM_ExchangeSupport_OA_BasicAuth", + "partition": "Common", + "fullPath": "/Common/_sys_APM_ExchangeSupport_OA_BasicAuth", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_APM_ExchangeSupport_OA_BasicAuth?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \n # Global variables\n # static::POLICY_RESULT_CACHE_AUTHFAILED\n # Administrator can set this into 1, when there is a necessity to cache failed policy result.\n # This may be needed to avoid account locked caused by the Active Sync device when it uses wrong passwords.\n # One possible scenario, is that when the user changes the password in Active Directory, but missed to changed in their devices.\n # Responses\n # On denied result\n # Administrator can customize the responses to the device depends on more complex conditions when necessary.\n # In those cases, please use ACCESS::respond command.\n # The following is the syntax of ACCESS::respond\n # ACCESS::respond [ content ] [ * ]\n # e.g. ACCESS::respond 401 content \"Error: Denied\" WWW-Authenticate \"basic realm=\\\"f5.com\\\"\" Connection close\n when RULE_INIT {\n # Please set the following global variables for customized responses.\n set static::actsync_401_http_body \"Authentication FailuredError: Authentication Failure\"\n set static::actsync_503_http_body \"Service is not availableError: Service is not available\"\n set static::ACCESS_LOG_PREFIX \"01490000:7:\"\n\n # Second Virtual Server name for 401 NTLM responder\n set static::ACCESS_SECOND_VIRTUAL_NAME \"_ACCESS_401_NTLM_responder_HTTPS\"\n\n set static::POLICY_INPROGRESS \"policy_inprogress\"\n set static::POLICY_AUTHFAILED \"policy_authfailed\"\n # The request with huge content length can not be used for starting ACCESS session.\n # This kind of request will be put on hold, and this iRule will try to use another\n # request to start the session. The following value is used for Outlook Anywhere.\n set static::OA_MAGIC_CONTENT_LEN 1073741824\n\n # Similar with OutlookAnywhere case, ACCESS can not use the request which is\n # larger then following size. This becomes an issue with application that using\n # Exchange Web Service as its main protocol such as Mac OS X applications\n # (e.g. Mail app, Microsoft Entourage, etc)\n # This kind of request will be put on hold, and this iRule will try to use another\n # request to start the session.\n set static::FIRST_BIG_POST_CONTENT_LEN 640000\n\n # Set it into 1 if the backend EWS handler accepts HTTP Basic Authentication.\n set static::EWS_BKEND_BASIC_AUTH 0\n # The following variable controls the polling mechanism.\n set static::POLICY_RESULT_POLL_INTERVAL 250\n set static::POLICY_RESULT_POLL_MAXRETRYCYCLE 600\n\n # Set this global variable to 1 for caching authentication failure\n # Useful for avoiding account locked out.\n set static::POLICY_RESULT_CACHE_AUTHFAILED 0\n\n # set this global variable to set alternative timeout for particular session\n set static::POLICY_ALT_INACTIVITY_TIMEOUT 120\n\n set static::ACCESS_USERKEY_TBLNAME \"_access_userkey\"\n\n\n set static::ACCESS_DEL_COOKIE_HDR_VAL \"MRHSession=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/\"\n\n log -noname accesscontrol.local1.debug \"01490000:7: EWS_BKEND_BASIC_AUTH = $static::EWS_BKEND_BASIC_AUTH\"\n }\n when ACCESS_ACL_ALLOWED {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX [HTTP::method] [HTTP::uri] [HTTP::header Content-Length]\"\n\n # MSFT Exchange's EWS request handler always requesting NTLM even the connection has been\n # already authenticated if there is a HTTP Basic Auth in the request.\n if { [ info exists f_exchange_web_service ] && $f_exchange_web_service == 1 } {\n if { $static::EWS_BKEND_BASIC_AUTH == 0 } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Removing HTTP Basic Authorization header\"\n HTTP::header remove Authorization\n }\n }\n }\n\n when HTTP_REQUEST {\n set http_path [ string tolower [HTTP::path] ]\n set f_clientless_mode 0\n set f_alt_inactivity_timeout 0\n set f_rpc_over_http 0\n set f_exchange_web_service 0\n set f_auto_discover 0\n set f_activesync 0\n set f_offline_address_book 0\n set f_availability_service 0\n\n # Here put appropriate pool when necessary.\n switch -glob $http_path {\n \"/rpc/rpcproxy.dll\" {\n # Supports for RPC over HTTP. (Outlook Anywhere)\n set f_rpc_over_http 1\n }\n \"/autodiscover/autodiscover.xml\" {\n # Supports for Auto Discover protocol.\n set f_auto_discover 1\n # This request does not require long inactivity timeout.\n # Don't use this for now\n set f_alt_inactivity_timeout 0\n }\n \"/microsoft-server-activesync\" {\n # Supports for ActiveSync\n set f_activesync 1\n }\n \"/oab/*\" {\n # Supports for Offline Address Book\n set f_offline_address_book 1\n # Don't use this for now\n set f_alt_inactivity_timeout 0\n }\n \"/ews/*\" {\n # Support for Exchange Web Service\n # Outlook's Availability Service borrows this protocol.\n set f_exchange_web_service 1\n }\n \"/as/*\" {\n # Support for Availability Service.\n # do nothing for now. (Untested)\n set f_availability_service 1\n }\n default {\n return\n }\n }\n\n set f_reqside_set_sess_id 0\n set http_method [HTTP::method]\n set http_hdr_host [HTTP::host]\n set http_hdr_uagent [HTTP::header User-Agent]\n set http_uri [HTTP::uri]\n set http_content_len [HTTP::header Content-Length]\n set MRHSession_cookie [HTTP::cookie value MRHSession]\n set auth_info_b64enc \"\"\n\n if { ! [ info exists src_ip ] } {\n set src_ip [IP::remote_addr]\n }\n if { ! [ info exists PROFILE_POLICY_TIMEOUT ] } {\n set PROFILE_POLICY_TIMEOUT [PROFILE::access access_policy_timeout]\n }\n if { ! [ info exists PROFILE_MAX_SESS_TIMEOUT ] } {\n set PROFILE_MAX_SESS_TIMEOUT [PROFILE::access max_session_timeout]\n }\n if { ! [ info exists PROFILE_RESTRICT_SINGLE_IP ] } {\n set PROFILE_RESTRICT_SINGLE_IP 1\n }\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX method: $http_method\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Src IP: $src_ip\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX User-Agent: $http_hdr_uagent\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP uri: $http_uri\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP len: $http_content_len\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Restrict-to-single-client-ip: $PROFILE_RESTRICT_SINGLE_IP\"\n\n # First, do we have valid MRHSession cookie.\n if { $MRHSession_cookie != \"\" } {\n if { [ACCESS::session exists -state_allow -sid $MRHSession_cookie] } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP *VALID* MRHSession cookie: $MRHSession_cookie\"\n } else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP *INVALID* MRHSession cookie: $MRHSession_cookie\"\n set MRHSession_cookie \"\"\n HTTP::cookie remove MRHSession\n }\n }\n\n set http_hdr_auth [HTTP::header Authorization]\n if { [ string match -nocase {basic *} $http_hdr_auth ] != 1 } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Not basic authentication. Ignore received auth header\"\n set http_hdr_auth \"\"\n }\n\n if { $http_hdr_auth == \"\" } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX No/Empty Auth header\"\n # clean up the cookie\n if { $MRHSession_cookie == \"\" } {\n HTTP::respond 401 content $static::actsync_401_http_body WWW-Authenticate \"Basic realm=\\\"[HTTP::header Host]\\\"\" Set-Cookie $static::ACCESS_DEL_COOKIE_HDR_VAL Connection Close\n return\n }\n # Do nothing if we have a valid MRHSession cookie.\n }\n\n set f_release_request 0\n # Optimization for clients which support cookie\n if { $MRHSession_cookie != \"\" } {\n # Default profile access setting is false\n if { $PROFILE_RESTRICT_SINGLE_IP == 0 } {\n set f_release_request 1\n }\n elseif { [ IP::addr $src_ip equals [ ACCESS::session data get -sid $MRHSession_cookie \"session.user.clientip\" ] ] } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX source IP matched\"\n set f_release_request 1\n }\n else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX source IP does not matched\"\n set MRHSession_cookie \"\"\n HTTP::cookie remove MRHSession\n }\n }\n\n if { $f_release_request == 0 } {\n set apm_username [string tolower [HTTP::username]]\n set apm_password [HTTP::password]\n if { $PROFILE_RESTRICT_SINGLE_IP == 0 } {\n binary scan [md5 \"$apm_password\"] H* user_hash\n }\n else {\n binary scan [md5 \"$apm_password$src_ip\"] H* user_hash\n }\n set user_key \"$apm_username.$user_hash\"\n unset user_hash\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP Hdr Auth: $http_hdr_auth\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX apm_username: $apm_username\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX user_key = $user_key\"\n set apm_cookie_list [ ACCESS::user getsid $user_key ]\n if { [ llength $apm_cookie_list ] != 0 } {\n set apm_cookie [ ACCESS::user getkey [ lindex $apm_cookie_list 0 ] ]\n if { $apm_cookie != \"\" } {\n HTTP::cookie insert name MRHSession value $apm_cookie\n set f_release_request 1\n }\n }\n }\n\n if { $http_content_len == $static::OA_MAGIC_CONTENT_LEN } {\n set f_oa_magic_content_len 1\n }\n\n set f_sleep_here 0\n set retry 1\n\n while { $f_release_request == 0 && $retry <= $static::POLICY_RESULT_POLL_MAXRETRYCYCLE } {\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Trying #$retry for $http_method $http_uri $http_content_len\"\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Reading $user_key from table $static::ACCESS_USERKEY_TBLNAME\"\n\n set apm_cookie [table lookup -subtable $static::ACCESS_USERKEY_TBLNAME -notouch $user_key]\n if { $apm_cookie != \"\" } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Verifying table cookie = $apm_cookie\"\n\n # Accessing SessionDB is not that cheap. Here we are trying to check known value.\n if { $apm_cookie == \"policy_authfailed\" || $apm_cookie == \"policy_inprogress\"} {\n # Do nothing\n } elseif { ! [ ACCESS::session exists $apm_cookie ] } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX table cookie = $apm_cookie is out-of-sync\"\n # Table value is out of sync. Ignores it.\n set apm_cookie \"\"\n }\n }\n\n switch $apm_cookie {\n \"\" {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX NO APM Cookie found\"\n\n if { [ info exists f_oa_magic_content_len ] && $f_oa_magic_content_len == 1 } {\n # Outlook Anywhere request comes in pair. The one with 1G payload is not usable\n # for creating new session since 1G content-length is intended for client to upload\n # the data when needed.\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Start to wait $static::POLICY_RESULT_POLL_INTERVAL ms for request with magic content-len\"\n set f_sleep_here 1\n } elseif { [ info exists f_exchange_web_service ] && $f_exchange_web_service == 1 && $http_content_len > $static::FIRST_BIG_POST_CONTENT_LEN } {\n # Here we are getting large EWS request, which can't be used for starting new session\n # in clientless-mode. Have it here waiting for next smaller one.\n # We are holding the request here in HTTP filter, and HTTP filter automatically\n # clamping down the TCP window when necessary.\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Start to wait $static::POLICY_RESULT_POLL_INTERVAL ms for big EWS request\"\n set f_sleep_here 1\n } else {\n set apm_cookie \"policy_inprogress\"\n set f_reqside_set_sess_id 1\n set f_release_request 1\n }\n }\n \"policy_authfailed\" {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Found $user_key with AUTH_FAILED\"\n HTTP::respond 401 content $static::actsync_401_http_body\n set f_release_request 1\n }\n \"policy_inprogress\" {\n if { [ info exists f_activesync ] && ($f_activesync == 1) } {\n # For ActiveSync requests, aggressively starts new session.\n set f_reqside_set_sess_id 1\n set f_release_request 1\n } else {\n set f_sleep_here 1\n }\n }\n default {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Using MRHSession = $apm_cookie\"\n HTTP::header insert Cookie \"MRHSession=$apm_cookie\"\n set f_release_request 1\n }\n }\n\n if { $f_reqside_set_sess_id == 1 } {\n set f_reqside_set_sess_id 0\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Setting $user_key=$apm_cookie $PROFILE_POLICY_TIMEOUT $PROFILE_POLICY_TIMEOUT\"\n set f_clientless_mode 1\n HTTP::cookie remove MRHSession\n HTTP::header insert \"clientless-mode\" 1\n HTTP::header insert \"username\" $apm_username\n HTTP::header insert \"password\" $apm_password\n table set -subtable $static::ACCESS_USERKEY_TBLNAME $user_key $apm_cookie $PROFILE_POLICY_TIMEOUT $PROFILE_POLICY_TIMEOUT\n }\n\n if { $f_sleep_here == 1 } {\n set f_sleep_here 0\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Waiting $static::POLICY_RESULT_POLL_INTERVAL ms for $http_method $http_uri\"\n after $static::POLICY_RESULT_POLL_INTERVAL\n }\n\n incr retry\n }\n\n if { ($f_release_request == 0) && ($retry >= $static::POLICY_RESULT_POLL_MAXRETRYCYCLE) } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Policy did not finish in [expr { $static::POLICY_RESULT_POLL_MAXRETRYCYCLE * $static::POLICY_RESULT_POLL_INTERVAL } ] ms. Close connection for $http_method $http_uri\"\n\n table delete -subtable $static::ACCESS_USERKEY_TBLNAME $user_key\n ACCESS::disable\n TCP::close\n return\n }\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Releasing request $http_method $http_uri\"\n }\n\n when ACCESS_SESSION_STARTED {\n if { [ info exists user_key ] } {\n\n ACCESS::session data set \"session.user.uuid\" $user_key\n ACCESS::session data set \"session.user.microsoft-exchange-client\" 1\n\n if { [ info exists f_activesync ] && $f_activesync == 1 } {\n ACCESS::session data set \"session.user.microsoft-activesync\" 1\n }\n elseif { [ info exists f_auto_discover ] && $f_auto_discover == 1 } {\n ACCESS::session data set \"session.user.microsoft-autodiscover\" 1\n }\n elseif { [ info exists f_availability_service ] && $f_availability_service == 1 } {\n ACCESS::session data set \"session.user.microsoft-availabilityservice\" 1\n }\n elseif { [ info exists f_rpc_over_http ] && $f_rpc_over_http == 1 } {\n ACCESS::session data set \"session.user.microsoft-rpcoverhttp\" 1\n }\n elseif { [ info exists f_offline_address_book ] && $f_offline_address_book == 1 } {\n ACCESS::session data set \"session.user.microsoft-offlineaddressbook\" 1\n }\n elseif { [ info exists f_exchange_web_service ] && $f_exchange_web_service == 1 } {\n ACCESS::session data set \"session.user.microsoft-exchangewebservice\" 1\n }\n }\n if { [ info exists f_alt_inactivity_timeout ] && $f_alt_inactivity_timeout == 1 } {\n ACCESS::session data set \"session.inactivity_timeout\" $static::POLICY_ALT_INACTIVITY_TIMEOUT\n }\n }\n\n when ACCESS_POLICY_COMPLETED {\n if { ! [ info exists user_key ] } {\n return\n }\n\n set user_key_value \"\"\n set f_delete_session 0\n set policy_result [ACCESS::policy result]\n set sid [ ACCESS::session sid ]\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX ACCESS_POLICY_COMPLETED: policy_result = \\\"$policy_result\\\" user_key = \\\"$user_key\\\" sid = \\\"$sid\\\"\"\n\n set inactivity_timeout [ACCESS::session data get \"session.inactivity_timeout\"]\n set max_sess_timeout [ACCESS::session data get \"session.max_session_timeout\"]\n if { $max_sess_timeout == \"\" } {\n set max_sess_timeout $PROFILE_MAX_SESS_TIMEOUT\n }\n\n switch $policy_result {\n \"allow\" {\n # We depends on this table record self-cleanup capability in order to\n # indirectly sync with session DB.\n set user_key_value $sid\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Result: Allow: $user_key => $sid $inactivity_timeout $max_sess_timeout\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX user_key_value = $user_key_value\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX sid = $sid\"\n }\n \"deny\" {\n # When necessary the admin here can check appropriate session variable\n # and decide what response more appropriate then this default response.\n ACCESS::respond 401 content $static::actsync_401_http_body Set-Cookie $static::ACCESS_DEL_COOKIE_HDR_VAL Connection Close\n if { $static::POLICY_RESULT_CACHE_AUTHFAILED == 1 } {\n set user_key_value $static::POLICY_AUTHFAILED\n } else {\n set f_delete_session 1\n }\n }\n default {\n ACCESS::respond 503 content $static::actsync_503_http_body Connection Close\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Got unsupported policy result for $user_key ($sid)\"\n set f_delete_session 1\n }\n }\n if { $user_key_value != \"\" } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Setting $user_key => $user_key_value $inactivity_timeout $max_sess_timeout in table $static::ACCESS_USERKEY_TBLNAME\"\n\n table set -subtable $static::ACCESS_USERKEY_TBLNAME $user_key $user_key_value $inactivity_timeout $max_sess_timeout\n } else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Deleting $user_key in table $static::ACCESS_USERKEY_TBLNAME\"\n\n table delete -subtable $static::ACCESS_USERKEY_TBLNAME $user_key\n }\n\n if { $f_delete_session == 1 } {\n ACCESS::session remove\n set f_delete_session 0\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Removing the session for $user_key.\"\n }\n }\ndefinition-signature CZnUb3niz9wZPWvOmjDB0Dy4ixqjBEhIZrAVGt8VYe7+wZkhcBUFTADz3S1y5uomVwhRkGL20PLH7tfanDlpr3+IppgAGQlp98sPUl5ndEoWA4Rr90QiRGNRl/V7jWK58SOdJCQOirnutVMoeYjBWLwuprXGts08PO0WML5s0xJNOY7WPuGNeG+7Ht2pIB0vu80CgnCNGZJGZH0QR3kMVOx3yUN0ro5bAOmQ/XWel4qkj0F5DN9ufvsmKtTvb+Lc3y+5PHGbbFAQIrZ7lntZUJl/F8e/d26HE3spmZzQpPzi16qYWaMOxbvT6oedxpyhwbmJLiRNGyZmnT6kHj93FA==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_APM_ExchangeSupport_OA_NtlmAuth", + "partition": "Common", + "fullPath": "/Common/_sys_APM_ExchangeSupport_OA_NtlmAuth", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_APM_ExchangeSupport_OA_NtlmAuth?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \nwhen RULE_INIT {\n set static::POLICY_INPROGRESS \"policy_inprogress\"\n set static::POLICY_FAILED \"policy_failed\"\n set static::POLICY_SUCCEED \"policy_succeed\"\n set static::POLICY_DONE_WAIT_SEC 5\n\n set static::FIRST_BIG_POST_CONTENT_LEN 640000\n set static::POLICY_RESULT_POLL_INTERVAL 100\n set static::POLICY_RESULT_POLL_MAXRETRYCYCLE 100\n set static::ACCESS_USERKEY_TBLNAME \"_access_userkey\"\n set static::ACCESS_LOG_PREFIX \"01490000:7:\"\n\n set static::USE_NTLM_AUTH 0\n set static::USE_BASIC_AUTH 1\n set static::USE_NTLM_BASIC_AUTH 2\n\n set static::URL_DEFAULT 0\n set static::URL_RPC_OVER_HTTP 1\n set static::URL_AUTODISCOVER 2\n set static::URL_ACTIVE_SYNC 3\n set static::URL_OFFLINEADDRESSBOOK 4\n set static::URL_EXCHANGEWEBSERVICE 5\n\n set static::RECVD_AUTH_NONE 0\n set static::RECVD_AUTH_NTLM 1\n set static::RECVD_AUTH_BASIC 2\n\n set static::ACCESS_DEL_COOKIE_HDR_VAL \"MRHSession=deleted; \\\n expires=Thu, 01-Jan-1970 00:00:01 GMT;\\\n path=/\"\n\n }\n\n when HTTP_REQUEST {\n set http_path [string tolower [HTTP::path]]\n set url_path $static::URL_DEFAULT\n set use_auth $static::USE_NTLM_AUTH\n set f_disable_sso 0\n\n switch -glob $http_path {\n \"/rpc/rpcproxy.dll\" {\n set url_path $static::URL_RPC_OVER_HTTP\n }\n \"/autodiscover/autodiscover.xml\" {\n set url_path $static::URL_ACTIVE_SYNC\n # Need to support both NTLM and Basic authentication for this URL\n set use_auth $static::USE_NTLM_BASIC_AUTH\n }\n \"/microsoft-server-activesync*\" {\n set url_path $static::URL_ACTIVE_SYNC\n # Use only Basic authentication for this URL\n set use_auth $static::USE_BASIC_AUTH\n set f_disable_sso 1\n }\n \"/oab*\" {\n set url_path $static::URL_OFFLINEADDRESSBOOK\n }\n \"/ews*\" {\n set url_path $static::URL_EXCHANGEWEBSERVICE\n }\n default {\n ECA::disable\n return\n }\n }\n\n if { ! [ info exists f_ntlm_auth_succeed ] } {\n set f_ntlm_auth_succeed 0\n }\n if { ! [ info exists sid_cache ] } {\n set sid_cache \"\"\n }\n if { ! [ info exists PROFILE_POLICY_TIMEOUT ] } { \n set PROFILE_POLICY_TIMEOUT [PROFILE::access access_policy_timeout]\n }\n if { ! [ info exists PROFILE_MAX_SESS_TIMEOUT ] } {\n set PROFILE_MAX_SESS_TIMEOUT [PROFILE::access max_session_timeout]\n }\n if { ! [ info exists src_ip ] } {\n set src_ip [IP::remote_addr]\n }\n if { ! [ info exists PROFILE_RESTRICT_SINGLE_IP ] } {\n set PROFILE_RESTRICT_SINGLE_IP 1\n }\n\n set http_method [HTTP::method]\n set http_hdr_host [HTTP::host]\n set http_hdr_uagent [HTTP::header User-Agent]\n set http_uri [HTTP::uri]\n set http_content_len [HTTP::header Content-Length]\n set MRHSession_cookie [HTTP::cookie value MRHSession]\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX method: $http_method\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Src IP: $src_ip\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX User-Agent: $http_hdr_uagent\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP uri: $http_uri\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP len: $http_content_len\"\n\n if { ! [ info exists ECA_METADATA_ARG ] } {\n # Generating argument for ECA::metadata\n # The NTLM configuration name is derived from assigned virtual name with the algorithm as follows:\n # ::= \"/\" as \"/\" is the last \"/\" char.\n # ::= \"/\" \"exch_ntlm\" \"_\" \n # e.g. Let us say the virtual name is \"/prod/exch/vs1\", The folder path is \"/prod/exch/\",\n # then object name will be \"/prod/exch/exch_ntlm_vs1\".\n set vs_name [virtual name]\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX virtual: $vs_name\"\n set slash_index [ string last / $vs_name ]\n if { $slash_index == -1 } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Error: the virtual name does not contain folder information\"\n ACCESS::disable\n TCP::close\n return\n }\n set ECA_METADATA_ARG \"select_ntlm:\"\n append ECA_METADATA_ARG [ string range $vs_name 0 $slash_index ]\n append ECA_METADATA_ARG \"exch_ntlm_\"\n append ECA_METADATA_ARG [ string range $vs_name [ expr { $slash_index + 1 } ] end ]\n unset slash_index\n unset vs_name\n }\n\n if { $use_auth == $static::USE_NTLM_AUTH } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Enable ECA: $ECA_METADATA_ARG\"\n ECA::enable\n ECA::select $ECA_METADATA_ARG\n return\n } else {\n set recvd_auth $static::RECVD_AUTH_NONE\n set http_hdr_auth [HTTP::header Authorization]\n set auth_data [split $http_hdr_auth \" \"]\n if { $http_hdr_auth != \"\" } {\n if { [ llength $auth_data ] == 2 } {\n set auth_scheme [ lindex $auth_data 0]\n if { [string equal -nocase $auth_scheme \"ntlm\" ] == 1 } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Recv'd HTTP NTLM Authentication\"\n set recvd_auth $static::RECVD_AUTH_NTLM\n } elseif { [ string equal -nocase [ lindex $auth_data 0] \"basic\" ] == 1 } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Recv'd HTTP Basic Authentication\"\n set recvd_auth $static::RECVD_AUTH_BASIC\n set user [string tolower [HTTP::username]]\n set password [HTTP::password]\n }\n }\n }\n if { $use_auth == $static::USE_BASIC_AUTH } {\n if { $recvd_auth == $static::RECVD_AUTH_BASIC } {\n # Defer the process until later\n } else {\n HTTP::respond 401 -version 1.1 noserver WWW-Authenticate \"Basic realm=\\\"$http_hdr_host\\\"\" \\\n Set-Cookie $static::ACCESS_DEL_COOKIE_HDR_VAL Connection Close\n return\n }\n } elseif { $use_auth == $static::USE_NTLM_BASIC_AUTH } {\n if { ($recvd_auth == $static::RECVD_AUTH_NTLM) || ($f_ntlm_auth_succeed == 1) } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Enable ECA: $ECA_METADATA_ARG\"\n ECA::enable\n ECA::select $ECA_METADATA_ARG\n return\n } elseif { $recvd_auth == $static::RECVD_AUTH_BASIC } {\n # Defer the process until later\n } else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Request Authorization: NTLM + Basic\"\n HTTP::respond 401 -version 1.1 noserver WWW-Authenticate \"Basic realm=\\\"$http_hdr_host\\\"\" \\\n WWW-Authenticate \"NTLM\" Set-Cookie $static::ACCESS_DEL_COOKIE_HDR_VAL Connection Close\n return\n }\n }\n\n # Disable NTLM auth\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Disable ECA\"\n ECA::disable\n # Disable KCD sso\n set f_disable_sso 1\n\n if { $MRHSession_cookie != \"\" } {\n if { [ACCESS::session exists -state_allow -sid $MRHSession_cookie] } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP *VALID* MRHSession cookie: $MRHSession_cookie\"\n # Default profile access setting is false\n if { $PROFILE_RESTRICT_SINGLE_IP == 0 } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Release the request\"\n return\n }\n elseif { [ IP::addr $src_ip equals [ ACCESS::session data get -sid $MRHSession_cookie \"session.user.clientip\" ] ] } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX source IP matched. Release the request\"\n return\n }\n else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX source IP does not matched\"\n }\n }\n else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP *INVALID* MRHSession cookie: $MRHSession_cookie\"\n }\n\n set MRHSession_cookie \"\"\n HTTP::cookie remove MRHSession\n }\n\n set user_key {}\n if { $PROFILE_RESTRICT_SINGLE_IP == 1 } {\n append user_key $src_ip\n }\n append user_key $password\n binary scan [md5 $user_key ] H* user_key\n set user_key \"$user.$user_key\"\n\n set apm_cookie_list [ ACCESS::user getsid $user_key ]\n if { [ llength $apm_cookie_list ] != 0 } {\n set MRHSession_cookie [ ACCESS::user getkey [ lindex $apm_cookie_list 0 ] ]\n if { $MRHSession_cookie != \"\" } {\n HTTP::cookie remove MRHSession \n HTTP::cookie insert name MRHSession value $MRHSession_cookie\n return\n }\n }\n\n HTTP::cookie remove MRHSession\n HTTP::header insert \"clientless-mode\" 1\n HTTP::header insert \"username\" $user\n HTTP::header insert \"password\" $password\n return\n }\n }\n\n when ECA_REQUEST_ALLOWED {\n set f_ntlm_auth_succeed 1\n\n if { $MRHSession_cookie == \"\" } {\n # Retrieve from SID cache\n set MRHSession_cookie $sid_cache\n HTTP::cookie insert name MRHSession value $sid_cache\n }\n\n if { $MRHSession_cookie != \"\" } {\n # Destroy session ID cache. This client should not need session ID cache \n if { ($sid_cache != \"\") && ($sid_cache != $MRHSession_cookie) } {\n set sid_cache \"\"\n }\n if { [ ACCESS::session exists -state_allow $MRHSession_cookie ] } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP *VALID* MRHSession cookie: $MRHSession_cookie\"\n # Default profile access setting is false\n if { $PROFILE_RESTRICT_SINGLE_IP == 0 } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Release the request\"\n return\n }\n elseif { [ IP::addr $src_ip equals [ ACCESS::session data get -sid $MRHSession_cookie \"session.user.clientip\" ] ] } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX source IP matched. Release the request\"\n return\n }\n else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX source IP does not matched\"\n }\n } else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP *INVALID* MRHSession cookie: $MRHSession_cookie\"\n }\n }\n\n set MRHSession \"\"\n set sid_cache \"\"\n HTTP::cookie remove MRHSession\n\n # Build user_key\n set user_key {}\n append user_key [string tolower [ECA::username]] \"@\" [ string tolower [ECA::domainname] ]\n if { $PROFILE_RESTRICT_SINGLE_IP == 0 } {\n append user_key \":\" $src_ip\n }\n append user_key \":\" [ECA::client_machine_name]\n\n set apm_cookie_list [ ACCESS::user getsid $user_key ]\n if { [ llength $apm_cookie_list ] != 0 } {\n set MRHSession_cookie [ ACCESS::user getkey [ lindex $apm_cookie_list 0 ] ]\n if { $MRHSession_cookie != \"\" } {\n set sid_cache $MRHSession_cookie\n HTTP::cookie insert name MRHSession value $MRHSession_cookie\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX APM Cookie found: $sid_cache\"\n return\n }\n }\n unset apm_cookie_list\n\n set try 1\n set start_policy_str $src_ip\n append start_policy_str [TCP::client_port]\n\n while { $try <= $static::POLICY_RESULT_POLL_MAXRETRYCYCLE } {\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX NO APM Cookie found\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Trying #$try for $http_method $http_uri $http_content_len\"\n\n if { $http_content_len > $static::FIRST_BIG_POST_CONTENT_LEN } {\n # Wait at below\n } else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX EXEC: table set -notouch -subtable $static::ACCESS_USERKEY_TBLNAME -excl $user_key $start_policy_str $PROFILE_POLICY_TIMEOUT $PROFILE_MAX_SESS_TIMEOUT\"\n set policy_status [table set -notouch -subtable $static::ACCESS_USERKEY_TBLNAME -excl $user_key $start_policy_str $PROFILE_POLICY_TIMEOUT $PROFILE_MAX_SESS_TIMEOUT]\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX DONE: table set -notouch -subtable $static::ACCESS_USERKEY_TBLNAME -excl $user_key $start_policy_str $PROFILE_POLICY_TIMEOUT $PROFILE_MAX_SESS_TIMEOUT\"\n if { $policy_status == $start_policy_str } {\n # ACCESS Policy has not started. Start one\n HTTP::header insert \"clientless-mode\" 1\n break\n } elseif { $policy_status == $static::POLICY_SUCCEED } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX table is out-of-sync retry\"\n table delete -subtable $static::ACCESS_USERKEY_TBLNAME $user_key\n continue\n } elseif { $policy_status == $static::POLICY_FAILED } {\n ACCESS::disable\n TCP::close\n return\n }\n # Wait at below\n }\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Waiting $static::POLICY_RESULT_POLL_INTERVAL ms for $http_method $http_uri\"\n # Touch the entry table\n table lookup -subtable $static::ACCESS_USERKEY_TBLNAME $user_key\n after $static::POLICY_RESULT_POLL_INTERVAL\n\n set apm_cookie_list [ ACCESS::user getsid $user_key ]\n if { [ llength $apm_cookie_list ] != 0 } {\n set MRHSession_cookie [ ACCESS::user getkey [ lindex $apm_cookie_list 0 ] ]\n if { $MRHSession_cookie != \"\" } {\n set sid_cache $MRHSession_cookie\n HTTP::cookie insert name MRHSession value $MRHSession_cookie\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX APM Cookie found: $sid_cache\"\n return\n }\n }\n\n incr try\n }\n\n if { $try > $static::POLICY_RESULT_POLL_MAXRETRYCYCLE } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Policy did not finish in [ expr { $static::POLICY_RESULT_POLL_MAXRETRYCYCLE * $static::POLICY_RESULT_POLL_INTERVAL } ] ms. Close connection for $http_method $http_uri\"\n table delete -subtable $static::ACCESS_USERKEY_TBLNAME $user_key\n ACCESS::disable\n TCP::close\n return\n }\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Releasing request $http_method $http_uri\"\n\n unset try\n unset start_policy_str\n }\n\n when ECA_REQUEST_DENIED {\n set f_ntlm_auth_succeed 0\n }\n\n when HTTP_RESPONSE_RELEASE {\n if { ! [info exists user_key] } {\n return\n }\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP response: status: [HTTP::status]\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP response: Server: [HTTP::header Server]\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP response: Content-Length: [HTTP::header Content-Length]\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP response: WWW-Authenticate: [HTTP::header WWW-Authenticate]\"\n }\n\n when ACCESS_SESSION_STARTED {\n if { [ info exists user_key ] } {\n ACCESS::session data set \"session.user.uuid\" $user_key\n ACCESS::session data set \"session.user.microsoft-exchange-client\" 1\n }\n }\n\n when ACCESS_ACL_ALLOWED {\n if { [ info exists f_disable_sso ] && $f_disable_sso == 1 } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Disable WEBSSO\"\n WEBSSO::disable\n }\n }\n\n when ACCESS_POLICY_COMPLETED {\n if { ! [ info exists user_key ] } {\n return\n }\n\n set user_key_value \"\"\n set f_delete_session 0\n set policy_result [ACCESS::policy result]\n set sid [ ACCESS::session sid ]\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX ACCESS_POLICY_COMPLETED: policy_result = \\\"$policy_result\\\" user_key = \\\"$user_key\\\" sid = \\\"$sid\\\"\"\n\n switch $policy_result {\n \"allow\" {\n set user_key_value $sid\n set sid_cache $user_key_value\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Result: Allow: $user_key\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX sid = $sid\"\n\n }\n \"deny\" {\n ACCESS::respond 401 content $static::actsync_401_http_body Set-Cookie $static::ACCESS_DEL_COOKIE_HDR_VAL Connection Close\n set f_delete_session 1\n }\n default {\n ACCESS::respond 503 content $static::actsync_503_http_body Connection Close\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Got unsupported policy result for $user_key ($sid)\"\n set f_delete_session 1\n }\n }\n\n if { $f_ntlm_auth_succeed == 1 } {\n if { $user_key_value != \"\" } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Setting $user_key => $static::POLICY_SUCCEED\"\n table set -subtable $static::ACCESS_USERKEY_TBLNAME $user_key $static::POLICY_SUCCEED\n } else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Setting $user_key => $static::POLICY_FAILED $static::POLICY_DONE_WAIT_SEC $static::POLICY_DONE_WAIT_SEC_in table $static::ACCESS_USERKEY_TBLNAME\"\n table set -subtable $static::ACCESS_USERKEY_TBLNAME $user_key $static::POLICY_FAILED $static::POLICY_DONE_WAIT_SEC $static::POLICY_DONE_WAIT_SEC\n }\n }\n\n if { $f_delete_session == 1 } {\n ACCESS::session remove\n set f_delete_session 0\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Removing the session for $user_key.\"\n }\n }\ndefinition-signature d/SlmwsO4YeDlh3eJpLqam9ytq0/EkWnAce1XTQ5bxOyla0x/VHjkr9dvoo3awaxp7lEjAenIgwGpS2jL5R1hq48WGZN2nu9LDKVjTosrq7j1MHbeKiIW8yXc3IEUtbbkhkAGNnMmfDYMD8Vg7l+iBx6B/WvRTZLr+tmppFf0BIr2Z7FWWU6c9OVl8YH1VuqqFX/lKICn2EXDhebRDRVvuXobLvbjZQxj+tqdUU2vuLzXYot/RUgClXHrg6Z2ZC6/WuAq4pp/XA2kvzWotQiY9gEceQdMC7/BxPSR8xo4VPNqkFkEPjh5hehZP0tFONTZaMaH1klVg4QbvHH5MRiBQ==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_APM_ExchangeSupport_helper", + "partition": "Common", + "fullPath": "/Common/_sys_APM_ExchangeSupport_helper", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_APM_ExchangeSupport_helper?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \n # The purpose of this iRule is for help the main virtual for the timing of the HTTP request retry\n # during the SSO process for OutlookAnywhere protocol request which has a Content-Length value of 1GB.\n\n when HTTP_REQUEST {\n # Waiting for the first chunk of data.\n HTTP::collect 1\n }\n\n when HTTP_REQUEST_DATA {\n # Respond 401 and close the connection once we received the data.\n HTTP::respond 401 WWW-Authenticate NTLM Connection close\n }\ndefinition-signature fnJWcC75FIDV4savxGjyZ5sTdRTen+3mItejhseH06qn+qBXjOl/j7wYRSLDv1IcFezF8BunbDftMHXrW7QRuPuxhjMIc4vaALE2CCGkO0xcs258F+nkPeeJKoR5mTHY/E5BWpOAISinUBUSA3/nUm8blXkMwVg/Q95360jcCOoi6csgJa97OSKIF9h9OQCylh1qGBsDRHEXCR3ycw5Eb4T2QQSdBn09vr8Hgdpi/9fUER97nzJe8T/RuoG+nQ7bc8F9yzG6nFa/CQtRYDybDrcNgllCfVloXZAHZS3dCpq6FnS/FaEWfSIujmV+lXkxY23Xz9Wf6i1h/feW9fEUiQ==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_APM_ExchangeSupport_main", + "partition": "Common", + "fullPath": "/Common/_sys_APM_ExchangeSupport_main", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_APM_ExchangeSupport_main?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \n # Global variables\n # static::POLICY_RESULT_CACHE_AUTHFAILED\n # Administrator can set this into 1, when there is a necessity to cache failed policy result.\n # This may be needed to avoid account locked caused by the Active Sync device when it uses wrong passwords.\n # One possible scenario, is that when the user changes the password in Active Directory, but missed to changed in their devices.\n # Responses\n # On denied result\n # Administrator can customize the responses to the device depends on more complex conditions when necessary.\n # In those cases, please use ACCESS::respond command.\n # The following is the syntax of ACCESS::respond\n # ACCESS::respond [ content ] [ * ]\n # e.g. ACCESS::respond 401 content \"Error: Denied\" WWW-Authenticate \"basic realm=\\\"f5.com\\\"\" Connection close\n when RULE_INIT {\n # Please set the following global variables for customized responses.\n set static::actsync_401_http_body \"Authentication FailuredError: Authentication Failure\"\n set static::actsync_503_http_body \"Service is not availableError: Service is not available\"\n set static::ACCESS_LOG_PREFIX \"01490000:7:\"\n\n # Second Virtual Server name for 401 NTLM responder\n set static::ACCESS_SECOND_VIRTUAL_NAME \"_ACCESS_401_NTLM_responder_HTTPS\"\n\n set static::POLICY_INPROGRESS \"policy_inprogress\"\n set static::POLICY_AUTHFAILED \"policy_authfailed\"\n # The request with huge content length can not be used for starting ACCESS session.\n # This kind of request will be put on hold, and this iRule will try to use another\n # request to start the session. The following value is used for Outlook Anywhere.\n set static::OA_MAGIC_CONTENT_LEN 1073741824\n\n # Similar with OutlookAnywhere case, ACCESS can not use the request which is\n # larger then following size. This becomes an issue with application that using\n # Exchange Web Service as its main protocol such as Mac OS X applications\n # (e.g. Mail app, Microsoft Entourage, etc)\n # This kind of request will be put on hold, and this iRule will try to use another\n # request to start the session.\n set static::FIRST_BIG_POST_CONTENT_LEN 640000\n\n # Set it into 1 if the backend EWS handler accepts HTTP Basic Authentication.\n set static::EWS_BKEND_BASIC_AUTH 0\n # Set it into 1 if the backend RPC-over-HTTP handler accepts HTTP Basic Authentication.\n set static::RPC_OVER_HTTP_BKEND_BASIC_AUTH 0\n # The following variable controls the polling mechanism.\n set static::POLICY_RESULT_POLL_INTERVAL 250\n set static::POLICY_RESULT_POLL_MAXRETRYCYCLE 600\n\n # Set this global variable to 1 for caching authentication failure\n # Useful for avoiding account locked out.\n set static::POLICY_RESULT_CACHE_AUTHFAILED 0\n\n # set this global variable to set alternative timeout for particular session\n set static::POLICY_ALT_INACTIVITY_TIMEOUT 120\n\n set static::ACCESS_USERKEY_TBLNAME \"_access_userkey\"\n\n\n set static::ACCESS_DEL_COOKIE_HDR_VAL \"MRHSession=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/\"\n\n log -noname accesscontrol.local1.debug \"01490000:7: RPC_OVER_HTTP_BKEND_BASIC_AUTH = $static::RPC_OVER_HTTP_BKEND_BASIC_AUTH\"\n log -noname accesscontrol.local1.debug \"01490000:7: EWS_BKEND_BASIC_AUTH = $static::EWS_BKEND_BASIC_AUTH\"\n }\n when ACCESS_ACL_ALLOWED {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX [HTTP::method] [HTTP::uri] [HTTP::header Content-Length]\"\n\n if { [ info exists f_rpc_over_http ] && $f_rpc_over_http == 1 } {\n if { $static::RPC_OVER_HTTP_BKEND_BASIC_AUTH == 0 } {\n if { [ info exists f_oa_magic_content_len ] && $f_oa_magic_content_len == 1 } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Use this virtual $static::ACCESS_SECOND_VIRTUAL_NAME just once. Will be reset back after disconnection.\"\n use virtual $static::ACCESS_SECOND_VIRTUAL_NAME\n }\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Remove HTTP Auth header\"\n HTTP::header remove Authorization\n }\n }\n # MSFT Exchange's EWS request handler always requesting NTLM even the connection has been\n # already authenticated if there is a HTTP Basic Auth in the request.\n if { [ info exists f_exchange_web_service ] && $f_exchange_web_service == 1 } {\n if { $static::EWS_BKEND_BASIC_AUTH == 0 } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Removing HTTP Basic Authorization header\"\n HTTP::header remove Authorization\n }\n }\n }\n\n when HTTP_REQUEST {\n set http_path [ string tolower [HTTP::path] ]\n set f_clientless_mode 0\n set f_alt_inactivity_timeout 0\n set f_rpc_over_http 0\n set f_exchange_web_service 0\n set f_auto_discover 0\n set f_activesync 0\n set f_offline_address_book 0\n set f_availability_service 0\n\n # Here put appropriate pool when necessary.\n switch -glob $http_path {\n \"/rpc/rpcproxy.dll\" {\n # Supports for RPC over HTTP. (Outlook Anywhere)\n set f_rpc_over_http 1\n }\n \"/autodiscover/autodiscover.xml\" {\n # Supports for Auto Discover protocol.\n set f_auto_discover 1\n # This request does not require long inactivity timeout.\n # Don't use this for now\n set f_alt_inactivity_timeout 0\n }\n \"/microsoft-server-activesync\" {\n # Supports for ActiveSync\n set f_activesync 1\n }\n \"/oab/*\" {\n # Supports for Offline Address Book\n set f_offline_address_book 1\n }\n \"/ews/*\" {\n # Support for Exchange Web Service\n # Outlook's Availability Service borrows this protocol.\n set f_exchange_web_service 1\n }\n \"/as/*\" {\n # Support for Availability Service.\n # do nothing for now. (Untested)\n set f_availability_service 1\n }\n default {\n return\n }\n }\n\n set f_reqside_set_sess_id 0\n set http_method [HTTP::method]\n set http_hdr_host [HTTP::host]\n set http_hdr_uagent [HTTP::header User-Agent]\n set src_ip [IP::remote_addr]\n set http_uri [HTTP::uri]\n set http_content_len [HTTP::header Content-Length]\n set MRHSession_cookie [HTTP::cookie value MRHSession]\n set auth_info_b64enc \"\"\n\n if { ! [ info exists PROFILE_POLICY_TIMEOUT ] } {\n set PROFILE_POLICY_TIMEOUT [PROFILE::access access_policy_timeout]\n }\n if { ! [ info exists PROFILE_MAX_SESS_TIMEOUT ] } {\n set PROFILE_MAX_SESS_TIMEOUT [PROFILE::access max_session_timeout]\n }\n if { ! [ info exists PROFILE_RESTRICT_SINGLE_IP ] } {\n set PROFILE_RESTRICT_SINGLE_IP 1\n }\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX method: $http_method\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Src IP: $src_ip\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX User-Agent: $http_hdr_uagent\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP uri: $http_uri\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP len: $http_content_len\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Restrict-to-single-client-ip: $PROFILE_RESTRICT_SINGLE_IP\"\n\n # First, do we have valid MRHSession cookie.\n if { $MRHSession_cookie != \"\" } {\n if { [ACCESS::session exists -state_allow -sid $MRHSession_cookie] } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP *VALID* MRHSession cookie: $MRHSession_cookie\"\n } else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP *INVALID* MRHSession cookie: $MRHSession_cookie\"\n set MRHSession_cookie \"\"\n HTTP::cookie remove MRHSession\n }\n }\n\n set http_hdr_auth [HTTP::header Authorization]\n if { [ string match -nocase {basic *} $http_hdr_auth ] != 1 } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Not basic authentication. Ignore received auth header\"\n set http_hdr_auth \"\"\n }\n\n if { $http_hdr_auth == \"\" } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX No/Empty Auth header\"\n # clean up the cookie\n if { $MRHSession_cookie == \"\" } {\n HTTP::respond 401 content $static::actsync_401_http_body WWW-Authenticate \"Basic realm=\\\"[HTTP::header Host]\\\"\" Set-Cookie $static::ACCESS_DEL_COOKIE_HDR_VAL Connection close\n return\n }\n # Do nothing if we have a valid MRHSession cookie.\n }\n\n set f_release_request 0\n # Optimization for clients which support cookie\n if { $MRHSession_cookie != \"\" } {\n # Default profile access setting is false\n if { $PROFILE_RESTRICT_SINGLE_IP == 0 } {\n set f_release_request 1\n }\n elseif { [ IP::addr $src_ip equals [ ACCESS::session data get -sid $MRHSession_cookie \"session.user.clientip\" ] ] } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX source IP matched\"\n set f_release_request 1\n }\n else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX source IP does not matched\"\n set MRHSession_cookie \"\"\n HTTP::cookie remove MRHSession\n }\n }\n\n if { $f_release_request == 0 } {\n set apm_username [ string tolower [HTTP::username]]\n set apm_password [HTTP::password]\n if { $PROFILE_RESTRICT_SINGLE_IP == 0 } {\n binary scan [md5 \"$apm_password\"] H* user_hash\n } else {\n binary scan [md5 \"$apm_password$src_ip\"] H* user_hash\n }\n\n set user_key {}\n append user_key $apm_username \".\" $user_hash\n unset user_hash\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP Hdr Auth: $http_hdr_auth\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX apm_username: $apm_username\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX user_key = $user_key\"\n set apm_cookie_list [ ACCESS::user getsid $user_key ]\n if { [ llength $apm_cookie_list ] != 0 } {\n set apm_cookie [ ACCESS::user getkey [ lindex $apm_cookie_list 0 ] ]\n if { $apm_cookie != \"\" } {\n HTTP::cookie insert name MRHSession value $apm_cookie\n set f_release_request 1\n }\n }\n }\n\n if { $http_content_len == $static::OA_MAGIC_CONTENT_LEN } {\n set f_oa_magic_content_len 1\n }\n\n set f_sleep_here 0\n set retry 1\n\n while { $f_release_request == 0 && $retry <= $static::POLICY_RESULT_POLL_MAXRETRYCYCLE } {\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Trying #$retry for $http_method $http_uri $http_content_len\"\n\n # This is also going to touch the table entry timer.\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Reading $user_key from table $static::ACCESS_USERKEY_TBLNAME\"\n\n set apm_cookie [table lookup -subtable $static::ACCESS_USERKEY_TBLNAME -notouch $user_key]\n if { $apm_cookie != \"\" } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Verifying table cookie = $apm_cookie\"\n\n # Accessing SessionDB is not that cheap. Here we are trying to check known value.\n if { $apm_cookie == \"policy_authfailed\" || $apm_cookie == \"policy_inprogress\"} {\n # Do nothing\n } elseif { ! [ ACCESS::session exists $apm_cookie ] } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX table cookie = $apm_cookie is out-of-sync\"\n # Table value is out of sync. Ignores it.\n set apm_cookie \"\"\n }\n }\n\n switch $apm_cookie {\n \"\" {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX NO APM Cookie found\"\n\n if { [ info exists f_oa_magic_content_len ] && $f_oa_magic_content_len == 1 } {\n # Outlook Anywhere request comes in pair. The one with 1G payload is not usable\n # for creating new session since 1G content-length is intended for client to upload\n # the data when needed.\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Start to wait $static::POLICY_RESULT_POLL_INTERVAL ms for request with magic content-len\"\n set f_sleep_here 1\n } elseif { [ info exists f_exchange_web_service ] && $f_exchange_web_service == 1 && $http_content_len > $static::FIRST_BIG_POST_CONTENT_LEN } {\n # Here we are getting large EWS request, which can't be used for starting new session\n # in clientless-mode. Have it here waiting for next smaller one.\n # We are holding the request here in HTTP filter, and HTTP filter automatically\n # clamping down the TCP window when necessary.\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Start to wait $static::POLICY_RESULT_POLL_INTERVAL ms for big EWS request\"\n set f_sleep_here 1\n } else {\n set apm_cookie \"policy_inprogress\"\n set f_reqside_set_sess_id 1\n set f_release_request 1\n }\n }\n \"policy_authfailed\" {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Found $user_key with AUTH_FAILED\"\n HTTP::respond 401 content $static::actsync_401_http_body\n set f_release_request 1\n }\n \"policy_inprogress\" {\n if { [ info exists f_activesync ] && ($f_activesync == 1) } {\n # For ActiveSync requests, aggressively starts new session.\n set f_reqside_set_sess_id 1\n set f_release_request 1\n } else {\n set f_sleep_here 1\n }\n }\n default {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Using MRHSession = $apm_cookie\"\n HTTP::header insert Cookie \"MRHSession=$apm_cookie\"\n set f_release_request 1\n }\n }\n\n if { $f_reqside_set_sess_id == 1 } {\n set f_reqside_set_sess_id 0\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Setting $user_key=$apm_cookie $PROFILE_POLICY_TIMEOUT $PROFILE_MAX_SESS_TIMEOUT\"\n set f_clientless_mode 1\n HTTP::cookie remove MRHSession\n HTTP::header insert \"clientless-mode\" 1\n HTTP::header insert \"username\" $apm_username\n HTTP::header insert \"password\" $apm_password\n table set -subtable $static::ACCESS_USERKEY_TBLNAME $user_key $apm_cookie $PROFILE_POLICY_TIMEOUT $PROFILE_MAX_SESS_TIMEOUT\n }\n\n if { $f_sleep_here == 1 } {\n set f_sleep_here 0\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Waiting $static::POLICY_RESULT_POLL_INTERVAL ms for $http_method $http_uri\"\n after $static::POLICY_RESULT_POLL_INTERVAL\n }\n\n incr retry\n }\n\n if { $f_release_request == 0 && $retry >= $static::POLICY_RESULT_POLL_MAXRETRYCYCLE } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Policy did not finish in [expr { $static::POLICY_RESULT_POLL_MAXRETRYCYCLE * $static::POLICY_RESULT_POLL_INTERVAL } ] ms. Close connection for $http_method $http_uri\"\n\n table delete -subtable $static::ACCESS_USERKEY_TBLNAME $user_key\n ACCESS::disable\n TCP::close\n return\n }\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Releasing request $http_method $http_uri\"\n }\n\n when ACCESS_SESSION_STARTED {\n if { [ info exists user_key ] } {\n ACCESS::session data set \"session.user.uuid\" $user_key\n ACCESS::session data set \"session.user.microsoft-exchange-client\" 1\n\n if { [ info exists f_activesync ] && $f_activesync == 1 } {\n ACCESS::session data set \"session.user.microsoft-activesync\" 1\n }\n elseif { [ info exists f_auto_discover ] && $f_auto_discover == 1 } {\n ACCESS::session data set \"session.user.microsoft-autodiscover\" 1\n }\n elseif { [ info exists f_availability_service ] && $f_availability_service == 1 } {\n ACCESS::session data set \"session.user.microsoft-availabilityservice\" 1\n }\n elseif { [ info exists f_rpc_over_http ] && $f_rpc_over_http == 1 } {\n ACCESS::session data set \"session.user.microsoft-rpcoverhttp\" 1\n }\n elseif { [ info exists f_offline_address_book ] && $f_offline_address_book == 1 } {\n ACCESS::session data set \"session.user.microsoft-offlineaddressbook\" 1\n }\n elseif { [ info exists f_exchange_web_service ] && $f_exchange_web_service == 1 } {\n ACCESS::session data set \"session.user.microsoft-exchangewebservice\" 1\n }\n }\n if { [ info exists f_alt_inactivity_timeout ] && $f_alt_inactivity_timeout == 1 } {\n ACCESS::session data set \"session.inactivity_timeout\" $static::POLICY_ALT_INACTIVITY_TIMEOUT\n }\n }\n\n when HTTP_RESPONSE {\n if { [ info exists f_auto_discover ] && $f_auto_discover == 1 } {\n set content_len [ HTTP::header Content-Length ]\n if { $content_len > 0 } {\n HTTP::collect $content_len\n }\n }\n }\n when HTTP_RESPONSE_DATA {\n if { [ info exists f_auto_discover ] && $f_auto_discover == 1 } {\n if { [ regsub -line {Ntlm} [ HTTP::payload ] {Basic} payload ] != 0 } {\n HTTP::payload replace 0 $content_len $payload\n }\n }\n }\n when ACCESS_POLICY_COMPLETED {\n if { ! [ info exists user_key ] } {\n return\n }\n\n set user_key_value \"\"\n set f_delete_session 0\n set policy_result [ACCESS::policy result]\n set sid [ ACCESS::session sid ]\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX ACCESS_POLICY_COMPLETED: policy_result = \\\"$policy_result\\\" user_key = \\\"$user_key\\\" sid = \\\"$sid\\\"\"\n\n set inactivity_timeout [ACCESS::session data get \"session.inactivity_timeout\"]\n set max_sess_timeout [ACCESS::session data get \"session.max_session_timeout\"]\n if { $max_sess_timeout == \"\" } {\n set max_sess_timeout $PROFILE_MAX_SESS_TIMEOUT\n }\n\n switch $policy_result {\n \"allow\" {\n # We depends on this table record self-cleanup capability in order to\n # indirectly sync with session DB.\n set user_key_value $sid\n\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Result: Allow: $user_key => $sid $inactivity_timeout $max_sess_timeout\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX user_key_value = $user_key_value\"\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX sid = $sid\"\n }\n \"deny\" {\n # When necessary the admin here can check appropriate session variable\n # and decide what response more appropriate then this default response.\n ACCESS::respond 401 content $static::actsync_401_http_body Set-Cookie $static::ACCESS_DEL_COOKIE_HDR_VAL Connection close\n if { $static::POLICY_RESULT_CACHE_AUTHFAILED == 1 } {\n set user_key_value $static::POLICY_AUTHFAILED\n } else {\n set f_delete_session 1\n }\n }\n default {\n ACCESS::respond 503 content $static::actsync_503_http_body Connection close\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Got unsupported policy result for $user_key ($sid)\"\n set f_delete_session 1\n }\n }\n if { $user_key_value != \"\" } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Setting $user_key => $user_key_value $inactivity_timeout $max_sess_timeout in table $static::ACCESS_USERKEY_TBLNAME\"\n\n table set -subtable $static::ACCESS_USERKEY_TBLNAME $user_key $user_key_value $inactivity_timeout $max_sess_timeout\n } else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Deleting $user_key in table $static::ACCESS_USERKEY_TBLNAME\"\n\n table delete -subtable $static::ACCESS_USERKEY_TBLNAME $user_key\n }\n\n if { $f_delete_session == 1 } {\n ACCESS::session remove\n set f_delete_session 0\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Removing the session for $user_key.\"\n }\n }\ndefinition-signature feX9LM+vB6YOEdVF+EA1JtNyVkPaB7gwdW0JzaB083MXl4yPP2nZnjm+WAx3YQhsmLttq5UkPl1zHpr5H9cwJX1bu9BNMi/+n0bIqWOipDHhhSYQ+TH+a5jQUSeftISr52BSQxh0cQKZkzM3rFU/qRZn9D9Dbf0kDGiDC1KWwVosrdjp5tVHOiQXWx8zybbGPFfgBcIBE6IvOvGbh5ohebVL2ADZm0URRj2NM4ZvZ2T3C14k2rHGXnDdRsvhmf5USZ+FH1hoKtWRxqtFjkWIaqw8leenXeot1j2bdKy92/AVTC9oZj1HJN1ePuQo5v414zlUhMEtkVy/gaxvj1+vPQ==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_APM_Office365_SAML_BasicAuth", + "partition": "Common", + "fullPath": "/Common/_sys_APM_Office365_SAML_BasicAuth", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_APM_Office365_SAML_BasicAuth?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \nwhen RULE_INIT {\n set static::ACCESS_LOG_ECP_PREFIX \"014d0002:7: ECP client\"\n }\n when HTTP_REQUEST {\n set http_path [string tolower [HTTP::path]]\n set http_hdr_auth [HTTP::header Authorization]\n set http_hdr_client_app [HTTP::header X-MS-Client-Application]\n set http_hdr_client_ip [HTTP::header X-MS-Forwarded-Client-IP]\n set MRHSession_cookie [HTTP::cookie value MRHSession]\n\n if { ($http_path == \"/saml/idp/profile/redirectorpost/sso\") &&\n ($http_hdr_client_app != \"\") &&\n ($http_hdr_client_app contains \"Microsoft.Exchange\") } {\n HTTP::uri \"/saml/idp/profile/ecp/sso\"\n } elseif { ($http_path != \"/saml/idp/profile/ecp/sso\") } {\n return\n }\n set f_saml_ecp_request 1\n unset http_path\n\n # If MRHSession cookie from client is present, skip further processing.\n if { $MRHSession_cookie != \"\" } {\n if { [ACCESS::session exists -state_allow -sid $MRHSession_cookie] } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_ECP_PREFIX HTTP *VALID* MRHSession cookie: $MRHSession_cookie\"\n } else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_ECP_PREFIX HTTP *INVALID* MRHSession cookie: $MRHSession_cookie\"\n }\n return\n }\n\n if { ($http_hdr_client_app != \"\") &&\n ($http_hdr_client_app contains \"Microsoft.Exchange\") &&\n ($http_hdr_client_ip != \"\") } {\n\t set src_ip $http_hdr_client_ip\n\t}\n unset http_hdr_client_app\n unset http_hdr_client_ip\n\n if { ! [ info exists src_ip ] } {\n set src_ip [IP::remote_addr]\n }\n\n # Only allow HTTP Basic Authentication.\n if { ($http_hdr_auth == \"\") || ([ string match -nocase {basic *} $http_hdr_auth ] != 1 ) } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_ECP_PREFIX ECP request does not contain HTTP Basic Authorization header.\"\n unset http_hdr_auth\n return\n }\n\n set apm_username [ string tolower [HTTP::username] ]\n set apm_password [HTTP::password]\n\n binary scan [md5 \"$apm_password$src_ip\"] H* user_hash\n set user_key {}\n append user_key $apm_username \".\" $user_hash\n unset user_hash\n\n set apm_cookie_list [ ACCESS::user getsid $user_key ]\n if { [ llength $apm_cookie_list ] != 0 } {\n set apm_cookie [ ACCESS::user getkey [ lindex $apm_cookie_list 0 ] ]\n if { $apm_cookie != \"\" } {\n HTTP::cookie insert name MRHSession value $apm_cookie\n }\n }\n\n HTTP::header insert \"clientless-mode\" 1\n HTTP::header insert \"username\" $apm_username\n HTTP::header insert \"password\" $apm_password\n unset apm_username\n unset apm_password\n unset http_hdr_auth\n }\n\n when ACCESS_SESSION_STARTED {\n if { [ info exists f_saml_ecp_request ] && $f_saml_ecp_request == 1 } {\n if { [ info exists user_key ] } {\n ACCESS::session data set \"session.user.uuid\" $user_key\n }\n if { [ info exists src_ip ] } {\n ACCESS::session data set \"session.user.clientip\" $src_ip\n }\n }\n }\n\n when HTTP_RESPONSE {\n if { [ info exists f_saml_ecp_request ] && $f_saml_ecp_request == 1 } {\n unset f_saml_ecp_request\n unset apm_cookie\n }\n }\ndefinition-signature hbkbqtFWuaW9oegh6SzMveAg8WY7+tJBg32EgZs3djEixBoxjXoktrb/mcfl3FmsQXRgE6LgrZCeIvjqLdk/8/wq/4wnd4naYm2VALVoBPeETuCpWdmiyiwuvFC5G4VlYhqhYhRsx9mQhbRWm8/YvoBpvNnCCSdyx/wL+KcYQGU7Zv4woZrtruq4RiLCm6ohutAWdS2NbeIQHG37NFXT6wV6pR9EIqrkNetbXAdi6OZGuuthSXMSXMz64+CwkzpptxP3bhOsFvM/gq8FfWR8rsRJfxaHg+njkkgKSkH3TL7vhDnL3pXcHhH1/9P6qDU++YAyiXzppOlLHib33Rv0yw==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_APM_activesync", + "partition": "Common", + "fullPath": "/Common/_sys_APM_activesync", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_APM_activesync?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \nwhen RULE_INIT {\n set static::actsync_401_http_body \"Authentication FailedError: Authentication Failure\"\n set static::actsync_503_http_body \"Service is not availableError: Service is not available\"\n set static::ACCESS_LOG_PREFIX \"01490000:7:\"\n }\n when HTTP_REQUEST {\n set http_path [string tolower [HTTP::path]]\n set f_clientless_mode 0\n\n if { $http_path == \"/microsoft-server-activesync\" } {\n }\n elseif { $http_path == \"/autodiscover/autodiscover.xml\" } {\n set f_auto_discover 1\n }\n else return\n\n if { ! [ info exists src_ip ] } {\n set src_ip [IP::remote_addr]\n }\n if { ! [ info exists PROFILE_RESTRICT_SINGLE_IP ] } {\n set PROFILE_RESTRICT_SINGLE_IP \t 1\n }\n # Only allow HTTP Basic Authentication.\n set auth_info_b64enc \"\"\n set http_hdr_auth [HTTP::header Authorization]\n regexp -nocase {Basic (.*)} $http_hdr_auth match auth_info_b64enc\n if { $auth_info_b64enc == \"\" } {\n set http_hdr_auth \"\"\n }\n\n if { $http_hdr_auth == \"\" } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX Empty/invalid HTTP Basic Authorization header\"\n HTTP::respond 401 content $static::actsync_401_http_body Connection close\n return\n }\n\n set MRHSession_cookie [HTTP::cookie value MRHSession]\n # Do we have valid MRHSession cookie.\n if { $MRHSession_cookie != \"\" } {\n if { [ACCESS::session exists -state_allow -sid $MRHSession_cookie] } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP *VALID* MRHSession cookie: $MRHSession_cookie\"\n # Default profile access setting is false\n if { $PROFILE_RESTRICT_SINGLE_IP == 0 } {\n return\n }\n elseif { [ IP::addr $src_ip equals [ ACCESS::session data get -sid $MRHSession_cookie \"session.user.clientip\" ] ] } {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX source IP matched\"\n return\n }\n else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX source IP does not matched\"\n }\n }\n else {\n log -noname accesscontrol.local1.debug \"$static::ACCESS_LOG_PREFIX HTTP *INVALID* MRHSession cookie: $MRHSession_cookie\"\n }\n set MRHSession_cookie \"\"\n HTTP::cookie remove MRHSession\n }\n\n set apm_username [ string tolower [HTTP::username] ]\n set apm_password [HTTP::password]\n\n if { $PROFILE_RESTRICT_SINGLE_IP == 0 } {\n binary scan [md5 \"$apm_password$\"] H* user_hash\n } else {\n binary scan [md5 \"$apm_password$src_ip\"] H* user_hash\n }\n set user_key {}\n append user_key $apm_username \".\" $user_hash\n unset user_hash\n\n set f_insert_clientless_mode 0\n set apm_cookie_list [ ACCESS::user getsid $user_key ]\n if { [ llength $apm_cookie_list ] != 0 } {\n set apm_cookie [ ACCESS::user getkey [ lindex $apm_cookie_list 0 ] ]\n if { $apm_cookie != \"\" } {\n HTTP::cookie insert name MRHSession value $apm_cookie\n } else {\n set f_insert_clientless_mode 1\n }\n } else {\n set f_insert_clientless_mode 1\n }\n\n if { $f_insert_clientless_mode == 1 } {\n HTTP::header insert \"clientless-mode\" 1\n HTTP::header insert \"username\" $apm_username\n HTTP::header insert \"password\" $apm_password\n }\n unset f_insert_clientless_mode\n }\n when ACCESS_SESSION_STARTED {\n if { [ info exists user_key ] } {\n ACCESS::session data set \"session.user.uuid\" $user_key\n ACCESS::session data set \"session.user.microsoft-exchange-client\" 1\n ACCESS::session data set \"session.user.activesync\" 1\n if { [ info exists f_auto_discover ] && $f_auto_discover == 1 } {\n set f_auto_discover 0\n ACCESS::session data set \"session.user.microsoft-autodiscover\" 1\n }\n }\n }\n when ACCESS_POLICY_COMPLETED {\n if { ! [ info exists user_key ] } {\n return\n }\n\n set policy_result [ACCESS::policy result]\n switch $policy_result {\n \"allow\" {\n }\n \"deny\" {\n ACCESS::respond 401 content $static::actsync_401_http_body Connection close\n ACCESS::session remove\n }\n default {\n ACCESS::respond 503 content $static::actsync_503_http_body Connection close\n ACCESS::session remove\n }\n }\n\n unset user_key\n }\ndefinition-signature jaSGZiyISQHfZu1LLt3cmS5U/vOKRUOkQZ6ZHyc0fdnKtv+VsbRUIgzQwpV1dsN+wzuFhWxEsvSzleGZSrRmlBRbO63jjeBg9jzCqj8/hfOHhPCMSP59w3/opbCnAlqt+TyCFDY1cJ6/b/SWS+irPeAt6gAl0kmw2TIBlJvxm93zTu8aWyBgQV+205oBEPjYVHjaFPGFPk5+5LnZWrBO1fC0jBqpkCT+LWxBGeVHRTC8sGup0SuhXFPfWu3oB1uTTo5SKr8ZxRUFUrLTHNj/W8RKWg2C34958TFngZNQhpxg+XGWEFJXpCkeM2fVJXN3mymRWxuanYLU26ZKXuNNxw==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_auth_krbdelegate", + "partition": "Common", + "fullPath": "/Common/_sys_auth_krbdelegate", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_auth_krbdelegate?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \nwhen HTTP_REQUEST {\n set thecert \"\"\n set ckname F5KRBAUTH\n set ckpass abc123\n set authprofiles [PROFILE::list auth]\n # Search the auth profiles for the krbdelegate(7) and grab cookie info\n foreach profname $authprofiles {\n if { [PROFILE::auth $profname type] == 7 } {\n set tmpckname [PROFILE::auth $profname cookie_name]\n set tmpckpass [PROFILE::auth $profname cookie_key]\n if {[PROFILE::auth $profname cookie_name] != \"\" } {\n set ckname $tmpckname\n set ckpass $tmpckpass\n break\n }\n }\n }\n set seecookie 0\n set insertcookie 0\n # check for the cookie\n if {not [info exists tmm_auth_http_sids(krbdelegate)]} {\n set tmm_auth_sid [AUTH::start pam default_krbdelegate]\n set tmm_auth_http_sids(krbdelegate) $tmm_auth_sid\n AUTH::subscribe $tmm_auth_sid\n } else {\n set tmm_auth_sid $tmm_auth_http_sids(krbdelegate)\n }\n if { [PROFILE::exists clientssl] } {\n set certcmd \"SSL::cert 0\"\n set thecert [ eval $certcmd ]\n }\n if { $thecert == \"\" } {\n # if no cert, assume old kerb delegation\n # if there is no Authorization header and no cookie, get one.\n if { ([HTTP::header Authorization] == \"\") and\n (not [HTTP::cookie exists $ckname])} {\n HTTP::respond 401 WWW-Authenticate Negotiate\n return\n }\n }\n if {[HTTP::cookie exists $ckname]} {\n set ckval [HTTP::cookie decrypt $ckname $ckpass]\n AUTH::username_credential $tmm_auth_sid \"cookie\"\n AUTH::password_credential $tmm_auth_sid $ckval\n set seecookie 1\n } else {\n if { $thecert == \"\" } {\n # Kerberos Delegation - set username\n # Strip off the Negotiate before the base64d goodness\n AUTH::username_credential $tmm_auth_sid [lindex [HTTP::header Authorization] 1]\n }\n else {\n # Protocol Transition - set ttm_auth_sid\n AUTH::username_credential $tmm_auth_sid \"krpprottran\"\n AUTH::cert_credential $tmm_auth_sid $thecert\n }\n AUTH::password_credential $tmm_auth_sid \"xxxx\"\n }\n AUTH::authenticate $tmm_auth_sid\n\n if {not [info exists tmm_auth_http_collect_count]} {\n HTTP::collect\n set tmm_auth_http_successes 0\n set tmm_auth_http_collect_count 1\n } else {\n incr tmm_auth_http_collect_count\n }\n }\n when AUTH_RESULT {\n if {not [info exists tmm_auth_http_sids(krbdelegate)] or \\\n ($tmm_auth_http_sids(krbdelegate) != [AUTH::last_event_session_id]) or \\\n (not [info exists tmm_auth_http_collect_count])} {\n return\n }\n if {[AUTH::status] == 0} {\n incr tmm_auth_http_successes\n }\n # If multiple auth sessions are pending and\n # one failure results in termination and this is a failure\n # or enough successes have now occurred\n if {([array size tmm_auth_http_sids] > 1) and \\\n ((not [info exists tmm_auth_http_sufficient_successes] or \\\n ($tmm_auth_http_successes >= $tmm_auth_http_sufficient_successes)))} {\n # Abort the other auth sessions\n foreach {type sid} [array get tmm_auth_http_sids] {\n unset tmm_auth_http_sids($type)\n if {($type ne \"krbdelegate\") and ($sid != -1)} {\n AUTH::abort $sid\n incr tmm_auth_http_collect_count -1\n }\n }\n }\n # If this is the last outstanding auth then either\n # release or respond to this session\n incr tmm_auth_http_collect_count -1\n if {$tmm_auth_http_collect_count == 0} {\n unset tmm_auth_http_collect_count\n if { [AUTH::status] == 0 } {\n array set pamout [AUTH::response_data]\n HTTP::header replace Authorization \"Negotiate $pamout(krbdelegate:attr:SPNEGO)\"\n if {$seecookie == 0} {\n set insertcookie $pamout(krbdelegate:attr:KRB5CCNAME)\n }\n HTTP::release\n } else {\n HTTP::respond 401 WWW-Authenticate Negotiate \"Set-Cookie\" \"$ckname= ; expires=Wed Dec 31 16:00:00 1969\"\n }\n }\n }\n # When the response goes out, if we need to insert a cookie, do it.\n when HTTP_RESPONSE {\n if {$insertcookie != 0} {\n HTTP::cookie insert name $ckname value $insertcookie\n HTTP::cookie encrypt $ckname $ckpass\n }\n }\ndefinition-signature mILi/VF69pqpNg+XJ4nClBl8+zq4v9FsiBYnKjX3zLZOChRWKt5CwkwpsbCRzx5DnvHglp9uXDYrjqcAFvM5aRA2R5LAhKQSq6pVPwHdZUJluYv0t3n6af/vSyc7KYsx6gga1jLuiFZaEzmG8c+r4igxwEee874iQBjYaWhHyKYGhlhly/Ez2FE9DNRpRepz2sq/jaKzEmmMod3CCXurXVGlC/Pk8qnbNid1yC15DGosrAKW1d8lhYbVBaXVQ1ahrr/UPYnDdHB1BiWUzRSS4uOKuUyUmT/xPI14/Nwv8zdFvlu+AnnD543zH6KhdSHhJ3zCVy2HSZ5wPuN3YswcBA==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_auth_ldap", + "partition": "Common", + "fullPath": "/Common/_sys_auth_ldap", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_auth_ldap?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \nwhen HTTP_REQUEST {\n if {not [info exists tmm_auth_http_sids(ldap)]} {\n set tmm_auth_sid [AUTH::start pam default_ldap]\n set tmm_auth_http_sids(ldap) $tmm_auth_sid\n if {[info exists tmm_auth_subscription]} {\n AUTH::subscribe $tmm_auth_sid\n }\n } else {\n set tmm_auth_sid $tmm_auth_http_sids(ldap)\n }\n AUTH::username_credential $tmm_auth_sid [HTTP::username]\n AUTH::password_credential $tmm_auth_sid [HTTP::password]\n AUTH::authenticate $tmm_auth_sid\n\n if {not [info exists tmm_auth_http_collect_count]} {\n HTTP::collect\n set tmm_auth_http_successes 0\n set tmm_auth_http_collect_count 1\n } else {\n incr tmm_auth_http_collect_count\n }\n }\n when AUTH_RESULT {\n if {not [info exists tmm_auth_http_sids(ldap)] or \\\n ($tmm_auth_http_sids(ldap) != [AUTH::last_event_session_id]) or \\\n (not [info exists tmm_auth_http_collect_count])} {\n return\n }\n if {[AUTH::status] == 0} {\n incr tmm_auth_http_successes\n }\n # If multiple auth sessions are pending and\n # one failure results in termination and this is a failure\n # or enough successes have now occurred\n if {([array size tmm_auth_http_sids] > 1) and \\\n ((not [info exists tmm_auth_http_sufficient_successes] or \\\n ($tmm_auth_http_successes >= $tmm_auth_http_sufficient_successes)))} {\n # Abort the other auth sessions\n foreach {type sid} [array get tmm_auth_http_sids] {\n unset tmm_auth_http_sids($type)\n if {($type ne \"ldap\") and ($sid != -1)} {\n AUTH::abort $sid\n incr tmm_auth_http_collect_count -1\n }\n }\n }\n\n # If this is the last outstanding auth then either\n # release or respond to this session\n incr tmm_auth_http_collect_count -1\n if {$tmm_auth_http_collect_count == 0} {\n unset tmm_auth_http_collect_count\n if {[AUTH::status] == 0} {\n HTTP::release\n } else {\n HTTP::respond 401\n }\n }\n }\ndefinition-signature d+BwFQlDUIY7Jf5jfpCFuEkwn/jJ+3ZjEQLQej71v7TxzQpxJps4rDaU2YxBNyM9CTAIWT3DRdLqYZAnIHqVpOIRIE/ALk0v0o79IxJIES4nUTE9UTHKM8GN13VBkihf1I8O9DmwOHgB1s0HV+A/dy5mDiyBFpbamyv6rJCASItyPp2Y7iKfcMHEFe+qgvZFA2B131QVAosIn6pFribwU5LSvArIul5pIgX1tcuI+BLPkaJy6xoN9AQcah/ufgUCOmAvkc/K5LteBkxG3ItldFNaxOtAPXDt5IDhrBuMxsvRs7P+vMbfNiGb+QSakipxML2EmwCRiacxQTZn/0DDrw==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_auth_radius", + "partition": "Common", + "fullPath": "/Common/_sys_auth_radius", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_auth_radius?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \nwhen HTTP_REQUEST {\n if {not [info exists tmm_auth_http_sids(radius)]} {\n set tmm_auth_sid [AUTH::start pam default_radius]\n set tmm_auth_http_sids(radius) $tmm_auth_sid\n if {[info exists tmm_auth_subscription]} {\n AUTH::subscribe $tmm_auth_sid\n }\n } else {\n set tmm_auth_sid $tmm_auth_http_sids(radius)\n }\n AUTH::username_credential $tmm_auth_sid [HTTP::username]\n AUTH::password_credential $tmm_auth_sid [HTTP::password]\n AUTH::authenticate $tmm_auth_sid\n\n if {not [info exists tmm_auth_http_collect_count]} {\n HTTP::collect\n set tmm_auth_http_successes 0\n set tmm_auth_http_collect_count 1\n } else {\n incr tmm_auth_http_collect_count\n }\n }\n when AUTH_RESULT {\n if {not [info exists tmm_auth_http_sids(radius)] or \\\n ($tmm_auth_http_sids(radius) != [AUTH::last_event_session_id]) or \\\n (not [info exists tmm_auth_http_collect_count])} {\n return\n }\n if {[AUTH::status] == 0} {\n incr tmm_auth_http_successes\n }\n # If multiple auth sessions are pending and\n # one failure results in termination and this is a failure\n # or enough successes have now occurred\n if {([array size tmm_auth_http_sids] > 1) and \\\n ((not [info exists tmm_auth_http_sufficient_successes] or \\\n ($tmm_auth_http_successes >= $tmm_auth_http_sufficient_successes)))} {\n # Abort the other auth sessions\n foreach {type sid} [array get tmm_auth_http_sids] {\n unset tmm_auth_http_sids($type)\n if {($type ne \"radius\") and ($sid != -1)} {\n AUTH::abort $sid\n incr tmm_auth_http_collect_count -1\n }\n }\n }\n # If this is the last outstanding auth then either\n # release or respond to this session\n incr tmm_auth_http_collect_count -1\n if {$tmm_auth_http_collect_count == 0} {\n unset tmm_auth_http_collect_count\n if { [AUTH::status] == 0 } {\n HTTP::release\n } else {\n HTTP::respond 401\n }\n }\n }\ndefinition-signature m0ZhOZjHe7lvErKAbir601WnOlWEPfEh/Qc5wayIKc6B16E4IF4F+Jh8QGdYRgNOrk3Qc3Gid6zQZcCcbIzfR3NKOxfVX+tl0KfiEN1lqBQMLu3/AooE+/YTC5oCPuvV6TK/JHRLiMiexYgRx6G+AFU7xg/w/YzgvV0bjsd9OxdIUB3WO5JOUweCG6q24zhVgN+3QIIiBnuKaMeHtRSw29xVpuQqgNKVG7RaPu15loA0xp8s4fxMF0YHDYPuQuu0PLfvYTqsSP0cI3Kdbsg5JgAIAcdHlFIW3NaUJBPMGRLOAvSGibIMVhFmUfC52LNQ4iORtokInaHyYUtPQ/yHIw==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_auth_ssl_cc_ldap", + "partition": "Common", + "fullPath": "/Common/_sys_auth_ssl_cc_ldap", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_auth_ssl_cc_ldap?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \nwhen CLIENT_ACCEPTED {\n set tmm_auth_ssl_cc_ldap_sid 0\n set tmm_auth_ssl_cc_ldap_done 0\n }\n when CLIENTSSL_CLIENTCERT {\n if {[SSL::cert count] == 0} {\n return\n }\n set tmm_auth_ssl_cc_ldap_done 0\n if {$tmm_auth_ssl_cc_ldap_sid == 0} {\n set tmm_auth_ssl_cc_ldap_sid [AUTH::start pam default_ssl_cc_ldap]\n if {[info exists tmm_auth_subscription]} {\n AUTH::subscribe $tmm_auth_ssl_cc_ldap_sid\n }\n }\n AUTH::cert_credential $tmm_auth_ssl_cc_ldap_sid [SSL::cert 0]\n AUTH::authenticate $tmm_auth_ssl_cc_ldap_sid\n SSL::handshake hold\n }\n when CLIENTSSL_HANDSHAKE {\n set tmm_auth_ssl_cc_ldap_done 1\n }\n when AUTH_RESULT {\n if {[info exists tmm_auth_ssl_cc_ldap_sid] and \\\n ($tmm_auth_ssl_cc_ldap_sid == [AUTH::last_event_session_id])} {\n set tmm_auth_status [AUTH::status]\n if {$tmm_auth_status == 0} {\n set tmm_auth_ssl_cc_ldap_done 1\n SSL::handshake resume\n } elseif {$tmm_auth_status != -1 || $tmm_auth_ssl_cc_ldap_done == 0} {\n reject\n }\n }\n }\ndefinition-signature O2ctQteahGXIbb4l9/vERvtwKeyl51hGNNGgccddtwme/6opsgPJu5gaiVGUXYYDkbcjFdfgDTU9oDPkLl5JmZ3VcExnlnvxLpVDuM/fKqxbgoRQZ6nl0mEceHmWxRY9AlhrODtJZxNRbQBu4OOCYS+yWioKgKkrBwQaEoIFBPSSUmeIPZHTXdNnLXwxxkY75O5Sc4sTkYQ3BvTrlu/frnwweed6qw9bWatN865CIzP3Spq0ELY0Q4bvxo+0JdLheFv2BfKUethrjEXcxiD9Ros0fnvQ83qaCHqt18xEyhakdKAf4gKZJt9UApkRn+1ZTPNJFzgQyPPYQGvU/y9JAQ==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_auth_ssl_crldp", + "partition": "Common", + "fullPath": "/Common/_sys_auth_ssl_crldp", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_auth_ssl_crldp?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \nwhen CLIENT_ACCEPTED {\n set tmm_auth_ssl_crldp_sid 0\n set tmm_auth_ssl_crldp_done 0\n }\n when CLIENTSSL_CLIENTCERT {\n if {[SSL::cert count] == 0} {\n return\n }\n set tmm_auth_ssl_crldp_done 0\n if {$tmm_auth_ssl_crldp_sid == 0} {\n set tmm_auth_ssl_crldp_sid [AUTH::start pam default_ssl_crldp]\n if {[info exists tmm_auth_subscription]} {\n AUTH::subscribe $tmm_auth_ssl_crldp_sid\n }\n }\n AUTH::cert_credential $tmm_auth_ssl_crldp_sid [SSL::cert 0]\n AUTH::cert_issuer_credential $tmm_auth_ssl_crldp_sid [SSL::cert issuer 0]\n AUTH::authenticate $tmm_auth_ssl_crldp_sid\n SSL::handshake hold\n }\n when CLIENTSSL_HANDSHAKE {\n set tmm_auth_ssl_crldp_done 1\n }\n when AUTH_RESULT {\n if {[info exists tmm_auth_ssl_crldp_sid] and \\\n ($tmm_auth_ssl_crldp_sid == [AUTH::last_event_session_id])} {\n set tmm_auth_status [AUTH::status]\n if {$tmm_auth_status == 0} {\n set tmm_auth_ssl_crldp_done 1\n SSL::handshake resume\n } elseif {$tmm_auth_status != -1 || $tmm_auth_ssl_crldp_done == 0} {\n reject\n }\n }\n }\ndefinition-signature PhTy24ctbtx0d4kFIFO6+Fr9W3a/7OetZ7nlh18mpH6BB9t1dB2LNayATLZ3q4iT4wLLdyyxA+g4jdrNBeuZVpM2JOBlhwcyIcTBFLQN4H/mkWErH4Vz9ZMxVduUxHN6fIh8zDQuJJYoRVlz087/vIVvk6ygbPwS9KqTdYBa3Nn79YmIVn1NXKyVoCg/40EZ3iNklwIfKctwqGU5ELKbhwk8CGCvexDbJcwRqv8nAETC4B/nc61jpGcihpOJchJFb3buTiAKwfxSYkx90UG4EnwsyA4GqUNIfS02Dj5rYSMH403CNNBKG2AA+ZGy9by2O3bb9lq/VNGPDmsnMEff1g==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_auth_ssl_ocsp", + "partition": "Common", + "fullPath": "/Common/_sys_auth_ssl_ocsp", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_auth_ssl_ocsp?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \nwhen CLIENT_ACCEPTED {\n set tmm_auth_ssl_ocsp_sid 0\n set tmm_auth_ssl_ocsp_done 0\n }\n when CLIENTSSL_CLIENTCERT {\n if {[SSL::cert count] == 0} {\n return\n }\n set tmm_auth_ssl_ocsp_done 0\n if {$tmm_auth_ssl_ocsp_sid == 0} {\n set tmm_auth_ssl_ocsp_sid [AUTH::start pam default_ssl_ocsp]\n if {[info exists tmm_auth_subscription]} {\n AUTH::subscribe $tmm_auth_ssl_ocsp_sid\n }\n }\n AUTH::cert_credential $tmm_auth_ssl_ocsp_sid [SSL::cert 0]\n AUTH::cert_issuer_credential $tmm_auth_ssl_ocsp_sid [SSL::cert issuer 0]\n AUTH::authenticate $tmm_auth_ssl_ocsp_sid\n SSL::handshake hold\n }\n when CLIENTSSL_HANDSHAKE {\n set tmm_auth_ssl_ocsp_done 1\n }\n when AUTH_RESULT {\n if {[info exists tmm_auth_ssl_ocsp_sid] and \\\n ($tmm_auth_ssl_ocsp_sid == [AUTH::last_event_session_id])} {\n set tmm_auth_status [AUTH::status]\n if {$tmm_auth_status == 0} {\n set tmm_auth_ssl_ocsp_done 1\n SSL::handshake resume\n } elseif {$tmm_auth_status != -1 || $tmm_auth_ssl_ocsp_done == 0} {\n reject\n }\n }\n }\ndefinition-signature mHRNmZiszQh85wPdt5PxM2ASLXyW47LE3CM5tS11M1lTe9ttjlWDc6yBdy5VFjC6H2O2DJ+fyrBmeMen16RVWPhUoq8YOJC9ZiuuLc6T/rW9GsopSHFPBLRjL/EPulNkuGB/DtxYvwXfXOyBuVRw+E/TYkKVi6cIrk4+e9mOnCo9biWycrRfemWwYyDCqouEaDK2huYnQ1rKyYAvIWxfd3rXXw6+jdpuvL/6RFXJjaLTJ/f1pVMHP5kuI2K/dkeojqDDgr1d1GnjIFFX2Azh5qZpaL1urPfn/M6C/7sXzew1PU0ow10MQtKKqAno5IpEpn+cPZlCs3d2Y1khtMqUug==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_auth_tacacs", + "partition": "Common", + "fullPath": "/Common/_sys_auth_tacacs", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_auth_tacacs?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \nwhen HTTP_REQUEST {\n if {not [info exists tmm_auth_http_sids(tacacs)]} {\n set tmm_auth_sid [AUTH::start pam default_tacacs]\n set tmm_auth_http_sids(tacacs) $tmm_auth_sid\n if {[info exists tmm_auth_subscription]} {\n AUTH::subscribe $tmm_auth_sid\n }\n } else {\n set tmm_auth_sid $tmm_auth_http_sids(tacacs)\n }\n AUTH::username_credential $tmm_auth_sid [HTTP::username]\n AUTH::password_credential $tmm_auth_sid [HTTP::password]\n AUTH::authenticate $tmm_auth_sid\n\n if {not [info exists tmm_auth_http_collect_count]} {\n HTTP::collect\n set tmm_auth_http_successes 0\n set tmm_auth_http_collect_count 1\n } else {\n incr tmm_auth_http_collect_count\n }\n }\n when AUTH_RESULT {\n if {not [info exists tmm_auth_http_sids(tacacs)] or \\\n ($tmm_auth_http_sids(tacacs) != [AUTH::last_event_session_id]) or \\\n (not [info exists tmm_auth_http_collect_count])} {\n return\n }\n if {[AUTH::status] == 0} {\n incr tmm_auth_http_successes\n }\n # If multiple auth sessions are pending and\n # one failure results in termination and this is a failure\n # or enough successes have now occurred\n if {([array size tmm_auth_http_sids] > 1) and \\\n ((not [info exists tmm_auth_http_sufficient_successes] or \\\n ($tmm_auth_http_successes >= $tmm_auth_http_sufficient_successes)))} {\n # Abort the other auth sessions\n foreach {type sid} [array get tmm_auth_http_sids] {\n unset tmm_auth_http_sids($type)\n if {($type ne \"tacacs\") and ($sid != -1)} {\n AUTH::abort $sid\n incr tmm_auth_http_collect_count -1\n }\n }\n }\n # If this is the last outstanding auth then either\n # release or respond to this session\n incr tmm_auth_http_collect_count -1\n if {$tmm_auth_http_collect_count == 0} {\n unset tmm_auth_http_collect_count\n if { [AUTH::status] == 0 } {\n HTTP::release\n } else {\n HTTP::respond 401\n }\n }\n }\ndefinition-signature GHNO23blFC/AnIkRk9DSySYK2LiesD7h2DliAMIsVIjBk/RFL8XvZ+8WuKMVibuCiAhPWWvUu6nKsTnk9pX5/kc4yV6qRHcaaO+UaqT1/KQZsVXShCf0YCzqjRQIduJhUFFn0MUDhDmo/8ti0Upo6loKBxW3TODx5y8Jf3dTKmX2oRMfrkiMEyVtv38O7MDwJ1H5/xF2z1r2+nWGUJThZq/ILpfzcdnI7X5j/PxnAGuL1zciRIZ/0RIyMvYch0GaoXaKLVaONzDm0nHEJ+hZ7Vp8mQZiRitc8MGs1Ku9yLamxosUFAdRVnNQOLXGrlvEm94oU6XR3mq0oeqx9+dnOQ==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "_sys_https_redirect", + "partition": "Common", + "fullPath": "/Common/_sys_https_redirect", + "generation": 1, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~_sys_https_redirect?ver=12.1.2", + "apiAnonymous": "nodelete nowrite \nwhen HTTP_REQUEST {\n HTTP::redirect https://[getfield [HTTP::host] \":\" 1][HTTP::uri]\n }\ndefinition-signature mwyl4XlRKRMQc0prWs7RtpgPcNfocOKb+MaFwAnQgAuUZZyG68OaGZsOCN3poUOFdHOc6fk2XAdGRmTRiP/7BCT7thsOX5zLFzA1N1wcr57KWVzEZt3ezxVXn2Z974OmbWm7P5Lclcr7N3adrLJMWfyfPPVF1tUYn0IQPD2QNMmfbcbr1oCuO93n/5dn0s6/EacHZGG53hVibW7xQuJXdMtoQ6ArSZ4U3n4vCDTb6NLYbAj6PirVzKY2pcsWFHFUSVrphSFwERc8+0XGHUE6Cb3ihzygoZc2cQ5jk3frFY70MkDluPTShFRbHd7PlMPRezrfkVZVeUHA/iBPcYcD+w==", + "apiRawValues": { + "verificationStatus": "signature-verified" + } + }, + { + "kind": "tm:ltm:rule:rulestate", + "name": "foo", + "partition": "Common", + "fullPath": "/Common/foo", + "generation": 94, + "selfLink": "https://localhost/mgmt/tm/ltm/rule/~Common~foo?ver=12.1.2", + "apiAnonymous": "when RULE_INIT {\n set static::FormBaseURL \"/sp-ofba-form\"\n set static::FormReturnURL \"/sp-ofba-completed\"\n set static::HeadAuthReq \"X-FORMS_BASED_AUTH_REQUIRED\"\n set static::HeadAuthRet \"X-FORMS_BASED_AUTH_RETURN_URL\"\n set static::HeadAuthSize \"X-FORMS_BASED_AUTH_DIALOG_SIZE\"\n set static::HeadAuthSizeVal \"800x600\"\n set static::ckname \"MRHSession_SP\"\n set static::Basic_Realm_Text \"SharePoint Authentication\"\n}\n\nwhen HTTP_REQUEST {\n set apmsessionid [HTTP::cookie value MRHSession]\n}\n\nwhen HTTP_RESPONSE {\n # Insert persistent cookie for html content type and private session\n}" + } +] diff --git a/test/units/modules/network/f5/test_bigip_irule.py b/test/units/modules/network/f5/test_bigip_irule.py new file mode 100644 index 00000000000..71d2fca37ae --- /dev/null +++ b/test/units/modules/network/f5/test_bigip_irule.py @@ -0,0 +1,271 @@ +# -*- coding: utf-8 -*- +# +# Copyright 2017 F5 Networks Inc. +# +# This file is part of Ansible +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public Liccense for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . + +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +import sys + +if sys.version_info < (2, 7): + from nose.plugins.skip import SkipTest + raise SkipTest("F5 Ansible modules require Python >= 2.7") + +import os +import json + +from ansible.compat.tests import unittest +from ansible.compat.tests.mock import patch, mock_open, Mock +from ansible.module_utils import basic +from ansible.module_utils._text import to_bytes +from ansible.module_utils.f5_utils import AnsibleF5Client +from ansible.module_utils.six import PY3 + +try: + from library.bigip_irule import Parameters + from library.bigip_irule import ModuleManager + from library.bigip_irule import ArgumentSpec + from library.bigip_irule import GtmManager + from library.bigip_irule import LtmManager +except ImportError: + from ansible.modules.network.f5.bigip_irule import Parameters + from ansible.modules.network.f5.bigip_irule import ModuleManager + from ansible.modules.network.f5.bigip_irule import ArgumentSpec + from ansible.modules.network.f5.bigip_irule import GtmManager + from ansible.modules.network.f5.bigip_irule import LtmManager + +fixture_path = os.path.join(os.path.dirname(__file__), 'fixtures') +fixture_data = {} + + +def set_module_args(args): + args = json.dumps({'ANSIBLE_MODULE_ARGS': args}) + basic._ANSIBLE_ARGS = to_bytes(args) + + +def load_fixture(name): + path = os.path.join(fixture_path, name) + + if path in fixture_data: + return fixture_data[path] + + with open(path) as f: + data = f.read() + + try: + data = json.loads(data) + except Exception: + pass + + fixture_data[path] = data + return data + + +class BigIpObj(object): + def __init__(self, **kwargs): + self.__dict__.update(kwargs) + + +class TestParameters(unittest.TestCase): + def test_module_parameters_ltm(self): + content = load_fixture('create_ltm_irule.tcl') + args = dict( + content=content, + module='ltm', + name='foo', + state='present' + ) + p = Parameters(args) + assert p.content == content.strip() + + def test_module_parameters_gtm(self): + content = load_fixture('create_gtm_irule.tcl') + args = dict( + content=content, + module='gtm', + name='foo', + state='present' + ) + p = Parameters(args) + assert p.content == content.strip() + + def test_api_parameters_ltm(self): + content = load_fixture('create_ltm_irule.tcl') + args = dict( + apiAnonymous=content + ) + p = Parameters(args) + assert p.content == content.strip() + + def test_return_api_params(self): + content = load_fixture('create_ltm_irule.tcl') + args = dict( + content=content, + module='ltm', + name='foo', + state='present' + ) + p = Parameters(args) + params = p.api_params() + + assert 'apiAnonymous' in params + + +@patch('ansible.module_utils.f5_utils.AnsibleF5Client._get_mgmt_root', + return_value=True) +class TestManager(unittest.TestCase): + + def setUp(self): + self.spec = ArgumentSpec() + self.ltm_irules = [] + self.gtm_irules = [] + + members = load_fixture('load_ltm_irules.json') + for item in members: + self.ltm_irules.append(BigIpObj(**item)) + + members = load_fixture('load_gtm_irules.json') + for item in members: + self.gtm_irules.append(BigIpObj(**item)) + + def test_create_ltm_irule(self, *args): + set_module_args(dict( + name='foo', + module='ltm', + content='this is my content', + partition='Common', + server='localhost', + password='password', + user='admin' + )) + + client = AnsibleF5Client( + argument_spec=self.spec.argument_spec, + supports_check_mode=self.spec.supports_check_mode, + f5_product_name=self.spec.f5_product_name, + mutually_exclusive=self.spec.mutually_exclusive, + ) + + # Override methods in the specific type of manager + tm = LtmManager(client) + tm.exists = Mock(side_effect=[False, True]) + tm.create_on_device = Mock(return_value=True) + + # Override methods to force specific logic in the module to happen + mm = ModuleManager(client) + mm.get_manager = Mock(return_value=tm) + + results = mm.exec_module() + + assert results['changed'] is True + assert results['content'] == 'this is my content' + + def test_create_gtm_irule(self, *args): + set_module_args(dict( + name='foo', + module='gtm', + content='this is my content', + partition='Common', + server='localhost', + password='password', + user='admin' + )) + + client = AnsibleF5Client( + argument_spec=self.spec.argument_spec, + supports_check_mode=self.spec.supports_check_mode, + f5_product_name=self.spec.f5_product_name, + mutually_exclusive=self.spec.mutually_exclusive, + ) + + # Override methods in the specific type of manager + tm = GtmManager(client) + tm.exists = Mock(side_effect=[False, True]) + tm.create_on_device = Mock(return_value=True) + + # Override methods to force specific logic in the module to happen + mm = ModuleManager(client) + mm.get_manager = Mock(return_value=tm) + + results = mm.exec_module() + + assert results['changed'] is True + assert results['content'] == 'this is my content' + + def test_create_gtm_irule_src(self, *args): + set_module_args(dict( + name='foo', + module='gtm', + src='/path/to/irules/foo.tcl', + partition='Common', + server='localhost', + password='password', + user='admin' + )) + + client = AnsibleF5Client( + argument_spec=self.spec.argument_spec, + supports_check_mode=self.spec.supports_check_mode, + f5_product_name=self.spec.f5_product_name, + mutually_exclusive=self.spec.mutually_exclusive, + ) + + if PY3: + builtins_name = 'builtins' + else: + builtins_name = '__builtin__' + + with patch(builtins_name + '.open', mock_open(read_data='this is my content'), create=True): + # Override methods in the specific type of manager + tm = GtmManager(client) + tm.exists = Mock(side_effect=[False, True]) + tm.create_on_device = Mock(return_value=True) + + # Override methods to force specific logic in the module to happen + mm = ModuleManager(client) + mm.get_manager = Mock(return_value=tm) + + results = mm.exec_module() + + assert results['changed'] is True + assert results['content'] == 'this is my content' + assert results['module'] == 'gtm' + assert results['src'] == '/path/to/irules/foo.tcl' + assert len(results.keys()) == 4 + + def test_module_mutual_exclusion(self, *args): + set_module_args(dict( + content='foo', + module='ltm', + name='foo', + state='present', + src='/path/to/irules/foo.tcl', + partition='Common', + server='localhost', + password='password', + user='admin' + )) + + with patch('ansible.module_utils.basic.AnsibleModule.fail_json', unsafe=True) as mo: + AnsibleF5Client( + argument_spec=self.spec.argument_spec, + supports_check_mode=self.spec.supports_check_mode, + f5_product_name=self.spec.f5_product_name, + mutually_exclusive=self.spec.mutually_exclusive, + ) + mo.assert_called_once()