For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Cspillane_18296's avatar
Cspillane_18296
Icon for Nimbostratus rankNimbostratus
Apr 30, 2015

HTTP::respond -reset flag

Hello everyone,

a couple of things about the HTTP::respond command with the "-reset" flag set; see http::respond:

1) If we use the syntax "HTTP::respond -reset 200" (i.e. the syntax defined in the wiki), it generates TCL errors like:

TCL error: /Common/file_rule - expected integer but got "-reset" while executing "HTTP::respond -reset 200 content blah blah blah

Obviously, TCP expects "HTTP::respond 200 etc..." not "HTTP::respond -reset 500 etc..."

So, If I move "-reset" flag to the end of the line (after the html/iFile that we are returning to the client) the TCL error no longer triggers, so we're working again (as you know a TCL error causes a clientside reset to be sent). Now, this brings us to point 2:

2) How does using -reset to "resets serverside connection instead of sinking the data." make sense?

There may not even be a server-side connection, since we have just received the HTTP request and are serving content from the f5, not sending a request to the server. See Standard virtual server with Layer 7 functionality

Maybe I am missing something?

Silly example iRule:

when HTTP_REQUEST {
switch [string tolower [HTTP::uri]] {
"/test" {
below line gives TCL error
HTTP::respond -reset 200 content "test"
log local0.alert "this works test" }
"/foo" {
below line does not give TCL error
HTTP::respond 200 content "foo" -reset
log local0.alert "this works foo" }
}
} 

Tested on 11.5.1 and 11.6.0.

Thanks in advance for your comments!

Chris

1 Reply

  • sfuerst_116779's avatar
    sfuerst_116779
    Historic F5 Account

    The -reset flag is useful when there is a server-side connection. (For example, in the HTTP_RESPONSE event, or if there is pipelining.)

     

    A use-case where it can help is when the server is responding with a 100MiB video file... but you want to HTTP::respond with something else. Normally, the HTTP filter will then sink the whole 100MiB response, wasting server resources. If you use the -reset flag, HTTP::respond will try to disconnect the server-side and reconnect to handle the next (pipelined) request.