For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Sake_Blok's avatar
Sake_Blok
Icon for Nimbostratus rankNimbostratus
May 29, 2012

Catching HTTP errors

Hi All,

 

 

To troubleshoot TCL errors in an iRule I use "catch" to catch the error and log some info to /var/log/ltm. This makes it easier to find the packet data in a network trace.

 

 

Now I would like to do the same for HTTP errors like these:

 

 

011f0007:3: http_process_state_prepend - Invalid action EV_EGRESS_DATA during ST_HTTP_PREPEND_HEADERS (Client side: vip=VS_HTTP profile=http pool=gateway-http)

 

 

011f0007:3: http_process_state_prepend - Invalid action EV_INGRESS_DATA during ST_HTTP_PREPEND_HEADERS (Server side: vip=VS_HTTP profile=http pool=gateway-http)

 

 

011f0005:3: HTTP header (33304) exceeded maximum allowed size of 32768 (Client side: vip=VS_HTTP profile=http pool=gateway-http)

 

 

Is there a way to detect these errors from within the iRule so that extra logging can be done to help in pinpointing the faulty session.

 

 

All tips are welcome! :-)

 

 

Cheers,

 

Sake

 

application delivery
dev
devops
iRules

1 Reply

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    May 31, 2012
    Hi Sake,

    These aren't iRule errors so it's not possible to handle them using the iRule catch command. Here's an option for logging large headers. You''ll need to increase the maximum headers limit on the HTTP profile first so the HTTP request will be parsed and the HTTP_REQUEST event will be triggered. Once you identify the large requests using the iRule you can lower the HTTP profile size limit if you want to. 

    
when HTTP_REQUEST {
 
        Check the total HTTP headers size
       if {[string length [HTTP::request]] > 10000 }{
 
               Check if the URI is very long
              if {[string length [HTTP::uri]] > 1000}{
 
                     log local0. "Uri is long. Length [string length [HTTP::uri]], URI: [HTTP::uri]"
 
                      Exit this event from this iRule
                     return
              }
 
               Loop through the headers by name
              foreach header {[HTTP::header names]} { 
 
                      Check for a long header value
                     if {[string length [HTTP::header value $header]] > 1000 } { 
                           log local0. "Header is long. Header Name: $header,\
                                  Length: [string length [HTTP::header value $header]], Value: [HTTP::header value $header]" 
                            Exit this event from this iRule
                           return
                     }
              }
 
               If we are still here the request was large, but not the URI or any single header.
               Log the first 1k bytes of the full request
              log local0. "Request is long: [HTTP::request]"
       }
}

    Aaron