For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

zenato_141472's avatar
zenato_141472
Icon for Nimbostratus rankNimbostratus
Jan 17, 2014

how to change https header response using irule

Hi all,

 

I am using LTM 6900. I have VS address : 10.251.227.231 pool address : 10.251.227.1 & 10.251.227.2

 

I access the website: https://10.251.227.231:8443

 

after succeed then the website redirect to this url : https://10.251.227.2:8443/claritysso/login?service=http%3A%2F%2F10.251.227.2%3A8080%2Fj_spring_cas_security_check or

 

https://10.251.227.1:8443/claritysso/login?service=http%3A%2F%2F10.251.227.1%3A8080%2Fj_spring_cas_security_check

 

my question is, how to change the redirect result from https://10.251.227.2:8443/claritysso/login?service=http%3A%2F%2F10.251.227.2%3A8080%2Fj_spring_cas_security_check become

 

https://10.251.227.231:8443/claritysso/login?service=http%3A%2F%2F10.251.227.231%3A8080%2Fj_spring_cas_security_check

 

so the header using VS IP address instead of the real IP in the pool

 

application delivery
BIG-IP Access Policy Manager (APM)
deployment
devops
iRules
oracle
security

5 Replies

  • Chris_Akker_129's avatar
    Chris_Akker_129
    Historic F5 Account
    Jan 20, 2014

    Hi Zenato. You probably don't need an iRule for this. You didn't specify what kind of HTTP server you are using, but it is important to create/add a Virtual Host definition on each server in the pool. The big-ip Virtual Server represents 2 or more physical servers. So to keep the Hostname portion of the URL from changing, OHS and Weblogic allow you to add a Virtual Hostname to each server. Here are some links to get you started, your Web server Admin should know how to do this stuff.

     

    http://docs.oracle.com/cd/E12839_01/core.1111/e12035/webtier_im.htm

     

    http://docs.oracle.com/cd/E14571_01/apirefs.1111/e13952/taskhelp/virtual_hosts/VirtualHosts.html

     

    If that does not work ( because your HTTP servers are old ), then you could try a big-ip STREAM profile, that will re-write the hostnames on the fly. You can check out the stream profile here:

     

    https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm_concepts_11_0_0/ltm_other_profiles.html1206878

     

    There is an example of using the Stream Profile with WLS in this deployment guide:

     

    http://www.f5.com/pdf/deployment-guides/iapp-weblogic-dg.pdf

     

    If none of that works, then you will need to write an iRule, and search Devcentral Codeshare for an example of Host re-write.

     

    Good Luck,

     

    Chris.

     

    • zenato_141472's avatar
      zenato_141472
      Icon for Nimbostratus rankNimbostratus
      Jan 20, 2014
      Hi Chris, thank you for the response. I'm using apache-tomcat-6.0.35 http server. I use stream profile, it succeed but can only replace one IP address. in my problem i have 2 source address (10.251.227.1 & 10.251.227.2). in stream profile i can only modify from 10.251.227.1 to 10.251.227.231, but i can't modify from 10.251.227.2 to 10.251.227.231.
  • Chris_Akker_129's avatar
    Chris_Akker_129
    Historic F5 Account
    Jan 21, 2014

    Did you look at the example in the deployment guide as I suggested ? It shows the Stream profile replacing TWO ServerIP's with the big-ip's VirtualIP.

     

    http://www.f5.com/pdf/deployment-guides/iapp-weblogic-dg.pdf

     

    To create a new Stream profile

     

    1. On the Main tab, expand Local Traffic, and then click Profiles.
    2. On the Menu bar, select Other, and then click Stream. The Stream Profiles screen opens.
    3. Click the Create button. The New Stream Profile screen opens.
    4. In the Name box, type a name for this profile. In our example, we type wls-stream.
    5. In the Target row, click the Custom box, and then use the following syntax to type the target:

    @@@@@@

     

    In our example, we type:

     

    @web0.weblogic10.example.com:7041@web.weblogic10.example.com@@web1.weblogic10.example.com:7041@web.weblogic10.example.com@

     

    In this example, we are searching for the host name "web0" and "web1", and replacing it with the host name of the virtual server "web" created by the template.

     

    The second search and replace pattern (following the @@) is for our second WebLogic Server. 6. Click the Finished button.

     

    However, I still highly recommend you fix the Apache server, so the Hostnames are redendered properly:

     

    http://tomcat.apache.org/tomcat-6.0-doc/config/host.html

     

    -Chris.

     

    • zenato_141472's avatar
      zenato_141472
      Icon for Nimbostratus rankNimbostratus
      Jan 21, 2014
      hi chris, i already found how to solve my issue. i used irules and stream profile like below : when HTTP_REQUEST { Disable the stream filter for all requests STREAM::disable } when HTTP_RESPONSE { Check if response type is text if {[HTTP::header value Content-Type] contains "text"}{ Replace IP addresses in response content with the string: 10.251.227.231 STREAM::expression "@10.251.227.1@10.251.227.231@ @10.251.227.2@10.251.227.231@" Enable the stream filter for this response only STREAM::enable } }
  • zenato_141472's avatar
    zenato_141472
    Icon for Nimbostratus rankNimbostratus
    Mar 03, 2014

    hi chris,

     

    last time I was succeed replace http header when user login : from https://10.251.227.1:8443/claritysso/login?service=http%3A%2F%2F10.251.227.1%3A8080%2Fj_spring_cas_security_check to https://10.251.227.231:8443/claritysso/login?service=http%3A%2F%2F10.251.227.231%3A8080%2Fj_spring_cas_security_check

     

    but when user logout why the response still use ip in the pool ya? here is the result URL of logout : https://10.251.227.1:8443/claritysso/logout or https://10.251.227.2:8443/claritysso/logout

     

    i'm expecting the result become : https://10.251.227.231:8443/claritysso/logout.

     

    How to make the stream profile sticky when the user login until user logout ?