For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jlindwall_19593's avatar
jlindwall_19593
Icon for Nimbostratus rankNimbostratus
May 11, 2015

Are iRule instances scoped to a request/response?

I have an iRule that sets a variable in HTTP_REQUEST. In HTTP_RESPONSE, I read that variable.

Is this going to work properly? What I am assuming (heh!) is that each request/response gets a unique instance of the iRule, or perhaps the data is somehow scoped to the specific request/response. I do not want the value of the variable that I set from request 1 to be read in the response handling of request 2.

when HTTP_REQUEST {
  set cnParamValue $value
}

when HTTP_RESPONSE {
    if { [info exists cnParamValue] and $cnParamValue ne "" } {
        log local0. $cnParamvalue
    }
}

5 Replies

  • As a general case, you can consider the iRule will be "unique" to a particular TCP connection for a client. There can be several HTTP Request/Response pairs from that client, but other connections or clients will have a their own copies of the variables.

     

  • Just adding to Roberts answer. Like he said, the variables are unique per connection. With HTTP pipelining there can be multiple requests within a connection. To make sure that a variable is "reset" for each request you can use the unset command, or set it to something generic in the beginning of the rule, such as an empty string or 0.

    In your rule the cnParamValue would be set each time the request is sent, and would not affect anything outside the connection it's in. If you want you could unset it in the HTTP_RESPONSE event.

    when HTTP_REQUEST {
      set cnParamValue $value
    }
    
    when HTTP_RESPONSE {
        if { [info exists cnParamValue] and $cnParamValue ne "" } {
            log local0. $cnParamvalue
            unset cnParamValue
        }
    }
    

    /Patrik

  • Hmmm, thanks for that info. I am now worried about my iRule.

     

    The iRule is looking for a particular request parameter in the request, and (if found) capturing it in the cnParamValue variable. In the response handling of the iRule I set a cookie using that cnParamValue.

     

    My hope was to set this cookie for the initial request of a resource; all subsequent requests for the duration of that browser session would include the cookie. This include requests for html, css, js, ajax calls, etc.

     

    Is this going to work? Browsers can create multiple connections to fetch resources. Will each of those connections receive the cookie value sent from that one initial request?

     

    If not, is there an alternate approach to this problem?

     

    Thanks!

     

  • I think you don't need to worry. I believe once you've set the cookie the browser would keep track of it for the length of the session regardless of connections. What usually mess things up is if you try to use them between multiple domains.

     

    The best way is to try. :)

     

    /Patrik

     

  • If you want to experiment you can add the connection close header in the HTTP_RESPONSE event. That would prevent the browser from using the same connection.

    when HTTP_REQUEST {
      set cnParamValue $value
    }
    
    when HTTP_RESPONSE {
        if { [info exists cnParamValue] and $cnParamValue ne "" } {
            log local0. $cnParamvalue
            HTTP::header insert Connection Close
            unset cnParamValue
        }
    }
    

    But like I said, you don't need to worry. 🙂

    /Patrik