Forum Discussion

Ahmad_03_151082's avatar
Ahmad_03_151082
Icon for Nimbostratus rankNimbostratus
Apr 29, 2015

HTTP to HTTPs exclude URLs

Hello

 

I am facing problem with my iRule which is redirect HTTP to HTTPs when HTTP_REQUEST { switch -glob [string tolower [HTTP::host][HTTP::uri]] { "xyz.com/pubportal/something" - "xyz.com/pubportal/anything" { Do nothing } default { HTTP::respond 302 location "https://[HTTP::host][HTTP::uri]" } } } this iRule to redirect http://xyz.com to https://xyz.com then it should exclude xyz.com/pubportal/something and xyz.com/pubportal/anything from this redirection but it doesnt work which meant the above iRule redirect everything to HTTPs. I have two virtual server HTTP and HTTPS Also i have created an iRule for pubportal on HTTP VS "/pubportal*" { HTTP::uri "[string range [HTTP::uri] 10 end]" }

 

I need a help!

 

36 Replies

  • Hi, After PPlying the above iRule i am getting the below error in log

    TCL error: /Common/EGA_Exclude_HTTPs  - Operation not supported. Multiple redirect/respond invocations not allowed (line 2) invoked from within "HTTP::redirect https://[HTTP::host][HTTP::uri]
    

    Any idea??

  • TCL error: /Common/EGA_Exclude_HTTPs - Operation not supported. Multiple redirect/respond invocations not allowed (line 2) invoked from within "HTTP::redirect https://[HTTP::host][HTTP::uri]

     

    you may check if there is condition that one request can match multiple redirect/respond commands (i.e. HTTP::redirect, HTTP::respond).

     

    if only one irule is assigned to virtual server, you may stop processing irule after redirect/respond by using return command.

     

    return

     

    https://devcentral.f5.com/wiki/iRules.return.ashx

     

    if multiple irules are assigned to virtual server, you may have to make sure same request does not match multiple redirect/respond actions. you can disable subsequent event by using event command.

     

    event

     

    https://devcentral.f5.com/wiki/iRules.event.ashx

     

  • I am using this iRule

     

    when HTTP_REQUEST { if {!( ([HTTP::uri] contains "WebServiceVehicleRegistration") or ([HTTP::uri] contains "InsuranceDetailsUploadWS") )} { HTTP::redirect https://[HTTP::host][HTTP::uri] } }

     

    I have 2 virtual server one for HTTP and the other for HTTPs i applied this iRule on HTTP VS

     

  • I am using this iRule

    can you post the virtual server configuration?

     tmsh list ltm virtual (name)
    
    • Ahmad_03_151082's avatar
      Ahmad_03_151082
      Icon for Nimbostratus rankNimbostratus
      Please find below: tmsh list ltm virtual Oservices.bahrain.bh_http_vs ltm virtual Oservices.bahrain.bh_http_vs { destination 192.168.214.6:http ip-protocol tcp mask 255.255.255.255 persist { services_cookie_persistence_profile { default yes } } pool oservices_pool profiles { oservice_http_profile { } tcp { } } rules { virtual.portal.redirect EGA_Exclude_HTTPs } source 0.0.0.0/0 source-address-translation { type automap } vlans { F5-DMZ-Prod-EXT } vlans-enabled vs-index 58 }
  • I am using this iRule

    can you post the virtual server configuration?

     tmsh list ltm virtual (name)
    
    • Ahmad_03_151082's avatar
      Ahmad_03_151082
      Icon for Nimbostratus rankNimbostratus
      Please find below: tmsh list ltm virtual Oservices.bahrain.bh_http_vs ltm virtual Oservices.bahrain.bh_http_vs { destination 192.168.214.6:http ip-protocol tcp mask 255.255.255.255 persist { services_cookie_persistence_profile { default yes } } pool oservices_pool profiles { oservice_http_profile { } tcp { } } rules { virtual.portal.redirect EGA_Exclude_HTTPs } source 0.0.0.0/0 source-address-translation { type automap } vlans { F5-DMZ-Prod-EXT } vlans-enabled vs-index 58 }
  • virtual.portal.redirect

     

    EGA_Exclude_HTTPs

     

    you have two irules, haven't you? you may check if there is condition that one request matches multiple redirect/respond.

     

    • Ahmad_03_151082's avatar
      Ahmad_03_151082
      Icon for Nimbostratus rankNimbostratus
      yes i have two iRule when HTTP_REQUEST { if { [HTTP::uri] equals "/" } { switch [string tolower [HTTP::host]] { "oservices.bahrain.bh" { HTTP::uri "/wps/portal"} "www.data.gov.bh" { HTTP::uri "/wps/portal/data" } "www.fsupport.gov.bh" { HTTP::uri "/wps/portal/fsupport" } "www.biciactions.bh" { HTTP::uri "/wps/portal/BICI" } "www.ega.gov.bh" { HTTP::uri "/wps/portal/egaptl" } "www.govactions.bh" { HTTP::uri "/wps/portal/EgovBICI" } "business.bahrain.bh" { HTTP::uri "/wps/portal/business" } "individual.bahrain.bh" { HTTP::uri "/wps/portal/individual" } "contact.bahrain.bh" { HTTP::uri "/wps/portal/contactus" } "visit.bahrain.bh"{ HTTP::uri "/wps/portal/visit" } "eParticipation.bahrain.bh" { HTTP::uri "/wps/portal/eParticipation" } "participate.bahrain.bh" { HTTP::uri "/wps/portal/participation" } "government.bahrain.bh" { HTTP::uri "/wps/portal/government" } "environment.bahrain.bh" { HTTP::uri "/wps/portal/environment" } } } else { switch -glob [HTTP::path] { "/wps/portal/NCCA" {HTTP::redirect "http://services.bahrain.bh/wps/portal/TawasulBe" } "/neaf" { HTTP::uri "/wps/portal/neaf" } "/Tawasul" { HTTP::uri "/wps/portal/ncs" } "/tawasul" { HTTP::uri "/wps/portal/ncs" } "/pubportal*" { HTTP::uri "[string range [HTTP::uri] 10 end]" } "/apps" {HTTP::redirect "https://apps.bahrain.bh/CMSWebApplication/action/AppStoreAction" } "/GovAppStar" { HTTP::uri "/wps/portal/GovAppStar" } "/blog" { HTTP::uri "/wps/portal/blog" } "/search" { HTTP::uri "/wps/portal/searchhomear" } "/mobile" { HTTP::redirect "http://mobile.bahrain.bh" } "/business" { HTTP::uri "/wps/portal/business" } "/mobile/Events" { HTTP::redirect "http://mobile.bahrain.bh/egov/wap/wml/mobile/common/calltoursub.do" } "/mobile/Hotel" { HTTP::redirect "http://mobile.bahrain.bh/egov/wap/wml/mobile/common/callhoteldir.do" } } } } the second one is when HTTP_REQUEST { if {!( ([HTTP::uri] contains "WebServiceVehicleRegistration") or ([HTTP::uri] contains "InsuranceDetailsUploadWS") )} { HTTP::redirect https://[HTTP::host][HTTP::uri] } } do you mean there is aconflict betwenn these two iRule?
  • virtual.portal.redirect

     

    EGA_Exclude_HTTPs

     

    you have two irules, haven't you? you may check if there is condition that one request matches multiple redirect/respond.

     

    • Ahmad_03_151082's avatar
      Ahmad_03_151082
      Icon for Nimbostratus rankNimbostratus
      yes i have two iRule when HTTP_REQUEST { if { [HTTP::uri] equals "/" } { switch [string tolower [HTTP::host]] { "oservices.bahrain.bh" { HTTP::uri "/wps/portal"} "www.data.gov.bh" { HTTP::uri "/wps/portal/data" } "www.fsupport.gov.bh" { HTTP::uri "/wps/portal/fsupport" } "www.biciactions.bh" { HTTP::uri "/wps/portal/BICI" } "www.ega.gov.bh" { HTTP::uri "/wps/portal/egaptl" } "www.govactions.bh" { HTTP::uri "/wps/portal/EgovBICI" } "business.bahrain.bh" { HTTP::uri "/wps/portal/business" } "individual.bahrain.bh" { HTTP::uri "/wps/portal/individual" } "contact.bahrain.bh" { HTTP::uri "/wps/portal/contactus" } "visit.bahrain.bh"{ HTTP::uri "/wps/portal/visit" } "eParticipation.bahrain.bh" { HTTP::uri "/wps/portal/eParticipation" } "participate.bahrain.bh" { HTTP::uri "/wps/portal/participation" } "government.bahrain.bh" { HTTP::uri "/wps/portal/government" } "environment.bahrain.bh" { HTTP::uri "/wps/portal/environment" } } } else { switch -glob [HTTP::path] { "/wps/portal/NCCA" {HTTP::redirect "http://services.bahrain.bh/wps/portal/TawasulBe" } "/neaf" { HTTP::uri "/wps/portal/neaf" } "/Tawasul" { HTTP::uri "/wps/portal/ncs" } "/tawasul" { HTTP::uri "/wps/portal/ncs" } "/pubportal*" { HTTP::uri "[string range [HTTP::uri] 10 end]" } "/apps" {HTTP::redirect "https://apps.bahrain.bh/CMSWebApplication/action/AppStoreAction" } "/GovAppStar" { HTTP::uri "/wps/portal/GovAppStar" } "/blog" { HTTP::uri "/wps/portal/blog" } "/search" { HTTP::uri "/wps/portal/searchhomear" } "/mobile" { HTTP::redirect "http://mobile.bahrain.bh" } "/business" { HTTP::uri "/wps/portal/business" } "/mobile/Events" { HTTP::redirect "http://mobile.bahrain.bh/egov/wap/wml/mobile/common/calltoursub.do" } "/mobile/Hotel" { HTTP::redirect "http://mobile.bahrain.bh/egov/wap/wml/mobile/common/callhoteldir.do" } } } } the second one is when HTTP_REQUEST { if {!( ([HTTP::uri] contains "WebServiceVehicleRegistration") or ([HTTP::uri] contains "InsuranceDetailsUploadWS") )} { HTTP::redirect https://[HTTP::host][HTTP::uri] } } do you mean there is aconflict betwenn these two iRule?
  • do you mean there is aconflict betwenn these two iRule?

    e.g.

     configuration 
    
    [root@ve11c:Active:In Sync] config  tmsh list ltm virtual bar
    ltm virtual bar {
        destination 172.28.24.10:80
        ip-protocol tcp
        mask 255.255.255.255
        pool foo
        profiles {
            http { }
            tcp { }
        }
        rules {
            one
            two
        }
        source 0.0.0.0/0
        source-address-translation {
            type automap
        }
        vs-index 7
    }
    [root@ve11c:Active:In Sync] config  tmsh list ltm rule one
    ltm rule one {
        when HTTP_REQUEST {
      if { [HTTP::uri] equals "/" } {
        switch [string tolower [HTTP::host]] {
          "oservices.bahrain.bh" { HTTP::uri "/wps/portal"}
          "www.data.gov.bh" { HTTP::uri "/wps/portal/data" }
          "www.fsupport.gov.bh" { HTTP::uri "/wps/portal/fsupport" }
          "www.biciactions.bh" { HTTP::uri "/wps/portal/BICI" }
          "www.ega.gov.bh" { HTTP::uri "/wps/portal/egaptl" }
          "www.govactions.bh" { HTTP::uri "/wps/portal/EgovBICI" }
          "business.bahrain.bh" { HTTP::uri "/wps/portal/business" }
          "individual.bahrain.bh" { HTTP::uri "/wps/portal/individual" }
          "contact.bahrain.bh" { HTTP::uri "/wps/portal/contactus" }
          "visit.bahrain.bh" { HTTP::uri "/wps/portal/visit" }
          "eParticipation.bahrain.bh" { HTTP::uri "/wps/portal/eParticipation" }
          "participate.bahrain.bh" { HTTP::uri "/wps/portal/participation" }
          "government.bahrain.bh" { HTTP::uri "/wps/portal/government" }
          "environment.bahrain.bh" { HTTP::uri "/wps/portal/environment" }
        }
      } else {
        switch -glob [HTTP::path] {
          "/wps/portal/NCCA" { HTTP::redirect "http://services.bahrain.bh/wps/portal/TawasulBe" }
          "/neaf" { HTTP::uri "/wps/portal/neaf" }
          "/Tawasul" { HTTP::uri "/wps/portal/ncs" }
          "/tawasul" { HTTP::uri "/wps/portal/ncs" }
          "/pubportal*" { HTTP::uri "[string range [HTTP::uri] 10 end]" }
          "/apps" { HTTP::redirect "https://apps.bahrain.bh/CMSWebApplication/action/AppStoreAction" }
          "/GovAppStar" { HTTP::uri "/wps/portal/GovAppStar" }
          "/blog" { HTTP::uri "/wps/portal/blog" }
          "/search" { HTTP::uri "/wps/portal/searchhomear" }
          "/mobile" { HTTP::redirect "http://mobile.bahrain.bh" }
          "/business" { HTTP::uri "/wps/portal/business" }
          "/mobile/Events" { HTTP::redirect "http://mobile.bahrain.bh/egov/wap/wml/mobile/common/calltoursub.do" }
          "/mobile/Hotel" { HTTP::redirect "http://mobile.bahrain.bh/egov/wap/wml/mobile/common/callhoteldir.do" }
        }
      }
    }
    }
    [root@ve11c:Active:In Sync] config  tmsh list ltm rule two
    ltm rule two {
        when HTTP_REQUEST {
      if { !( ([HTTP::uri] contains "WebServiceVehicleRegistration") or ([HTTP::uri] contains "InsuranceDetailsUploadWS") ) } {
        HTTP::redirect https://[HTTP::host][HTTP::uri]
      }
    }
    }
    
     test
    
    [root@ve11c:Active:In Sync] config  curl -I http://172.28.24.10/wps/portal/NCCA
    HTTP/1.0 302 Found
    Location: http://services.bahrain.bh/wps/portal/TawasulBe
    Server: BigIP
    Connection: Keep-Alive
    Content-Length: 0
    
    [root@ve11c:Active:In Sync] config  tail /var/log/ltm
    May 14 15:37:16 ve11c err tmm[15145]: 01220001:3: TCL error: /Common/two  - Operation not supported. Multiple redirect/respond invocations not allowed (line 1)     invoked from within "HTTP::redirect https://[HTTP::host][HTTP::uri] "
    
    • Ahmad_03_151082's avatar
      Ahmad_03_151082
      Icon for Nimbostratus rankNimbostratus
      for http://oservices.bahrain.bh/wps/portal/NCCA it will redirect you to another domain http://services.bahrain.bh and I have enabled the SSL on this domain also,so i changed the iRule "/wps/portal/NCCA" { HTTP::redirect "http://services.bahrain.bh/wps/portal/TawasulBe" to "/wps/portal/NCCA" { HTTP::redirect "https://services.bahrain.bh/wps/portal/TawasulBe" but still get the same error.
    • nitass's avatar
      nitass
      Icon for Employee rankEmployee
      one request matches two patterns. you have to correct patterns rather than correcting body.
  • do you mean there is aconflict betwenn these two iRule?

    e.g.

     configuration 
    
    [root@ve11c:Active:In Sync] config  tmsh list ltm virtual bar
    ltm virtual bar {
        destination 172.28.24.10:80
        ip-protocol tcp
        mask 255.255.255.255
        pool foo
        profiles {
            http { }
            tcp { }
        }
        rules {
            one
            two
        }
        source 0.0.0.0/0
        source-address-translation {
            type automap
        }
        vs-index 7
    }
    [root@ve11c:Active:In Sync] config  tmsh list ltm rule one
    ltm rule one {
        when HTTP_REQUEST {
      if { [HTTP::uri] equals "/" } {
        switch [string tolower [HTTP::host]] {
          "oservices.bahrain.bh" { HTTP::uri "/wps/portal"}
          "www.data.gov.bh" { HTTP::uri "/wps/portal/data" }
          "www.fsupport.gov.bh" { HTTP::uri "/wps/portal/fsupport" }
          "www.biciactions.bh" { HTTP::uri "/wps/portal/BICI" }
          "www.ega.gov.bh" { HTTP::uri "/wps/portal/egaptl" }
          "www.govactions.bh" { HTTP::uri "/wps/portal/EgovBICI" }
          "business.bahrain.bh" { HTTP::uri "/wps/portal/business" }
          "individual.bahrain.bh" { HTTP::uri "/wps/portal/individual" }
          "contact.bahrain.bh" { HTTP::uri "/wps/portal/contactus" }
          "visit.bahrain.bh" { HTTP::uri "/wps/portal/visit" }
          "eParticipation.bahrain.bh" { HTTP::uri "/wps/portal/eParticipation" }
          "participate.bahrain.bh" { HTTP::uri "/wps/portal/participation" }
          "government.bahrain.bh" { HTTP::uri "/wps/portal/government" }
          "environment.bahrain.bh" { HTTP::uri "/wps/portal/environment" }
        }
      } else {
        switch -glob [HTTP::path] {
          "/wps/portal/NCCA" { HTTP::redirect "http://services.bahrain.bh/wps/portal/TawasulBe" }
          "/neaf" { HTTP::uri "/wps/portal/neaf" }
          "/Tawasul" { HTTP::uri "/wps/portal/ncs" }
          "/tawasul" { HTTP::uri "/wps/portal/ncs" }
          "/pubportal*" { HTTP::uri "[string range [HTTP::uri] 10 end]" }
          "/apps" { HTTP::redirect "https://apps.bahrain.bh/CMSWebApplication/action/AppStoreAction" }
          "/GovAppStar" { HTTP::uri "/wps/portal/GovAppStar" }
          "/blog" { HTTP::uri "/wps/portal/blog" }
          "/search" { HTTP::uri "/wps/portal/searchhomear" }
          "/mobile" { HTTP::redirect "http://mobile.bahrain.bh" }
          "/business" { HTTP::uri "/wps/portal/business" }
          "/mobile/Events" { HTTP::redirect "http://mobile.bahrain.bh/egov/wap/wml/mobile/common/calltoursub.do" }
          "/mobile/Hotel" { HTTP::redirect "http://mobile.bahrain.bh/egov/wap/wml/mobile/common/callhoteldir.do" }
        }
      }
    }
    }
    [root@ve11c:Active:In Sync] config  tmsh list ltm rule two
    ltm rule two {
        when HTTP_REQUEST {
      if { !( ([HTTP::uri] contains "WebServiceVehicleRegistration") or ([HTTP::uri] contains "InsuranceDetailsUploadWS") ) } {
        HTTP::redirect https://[HTTP::host][HTTP::uri]
      }
    }
    }
    
     test
    
    [root@ve11c:Active:In Sync] config  curl -I http://172.28.24.10/wps/portal/NCCA
    HTTP/1.0 302 Found
    Location: http://services.bahrain.bh/wps/portal/TawasulBe
    Server: BigIP
    Connection: Keep-Alive
    Content-Length: 0
    
    [root@ve11c:Active:In Sync] config  tail /var/log/ltm
    May 14 15:37:16 ve11c err tmm[15145]: 01220001:3: TCL error: /Common/two  - Operation not supported. Multiple redirect/respond invocations not allowed (line 1)     invoked from within "HTTP::redirect https://[HTTP::host][HTTP::uri] "
    
    • Ahmad_03_151082's avatar
      Ahmad_03_151082
      Icon for Nimbostratus rankNimbostratus
      for http://oservices.bahrain.bh/wps/portal/NCCA it will redirect you to another domain http://services.bahrain.bh and I have enabled the SSL on this domain also,so i changed the iRule "/wps/portal/NCCA" { HTTP::redirect "http://services.bahrain.bh/wps/portal/TawasulBe" to "/wps/portal/NCCA" { HTTP::redirect "https://services.bahrain.bh/wps/portal/TawasulBe" but still get the same error.
    • nitass_89166's avatar
      nitass_89166
      Icon for Noctilucent rankNoctilucent
      one request matches two patterns. you have to correct patterns rather than correcting body.