For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

William_Franz_1's avatar
William_Franz_1
Icon for Nimbostratus rankNimbostratus
Feb 23, 2015

iRule- Operation not supported. Multiple redirect/respond invocations not allowed

Hello community,

 

I'm by know means a Tcl expert and I normally only handle generic type of scripts. I've searched around regarding the error in the subject and I've adjusted the script to the best of my ability at this point.

 

Can someone be kind enough to look at the below code and tell me if something jumps out at them that looks incorrect? Also, in regards to the invoke incrementing does it start at 0 and go to 1 for each elsif or does it keep incrementing, for example, 1, 2, 3, 4?

 

Thanks in advance,

 

Bill

 

when HTTP_REQUEST {

 

set uri [HTTP::uri] set invoke 0 if {([string tolower [HTTP::path]] contains "/connect/beachbody-challenge/pledge") } { incr invoke regsub "/connect/beachbody-challenge/pledge" $uri "/beachbody-challenge/participate-commit-now" uri

 

} elseif {([string tolower [HTTP::path]] contains "/connect/beachbody-challenge/entry") } { incr invoke regsub "/connect/beachbody-challenge/entry" $uri "/beachbody-challenge/enter-contest" uri

 

} elseif {([string tolower [HTTP::path]] contains "/connect/beachbody-challenge/winners-monthly") } { incr invoke regsub "/connect/beachbody-challenge/winners-monthly" $uri "/beachbody-challenge/contest-info-and-contest-winners" uri

 

} elseif {([string tolower [HTTP::path]] contains "/connect/beachbody-challenge/winners-quarterly") } { incr invoke regsub "/connect/beachbody-challenge/winners-quarterly" $uri "/beachbody-challenge/contest-info-and-contest-winners" uri

 

} elseif {([string tolower [HTTP::path]] contains "/connect/beachbody-challenge/winners-final") } { incr invoke regsub "/connect/beachbody-challenge/winners-final" $uri "/beachbody-challenge/contest-info-and-contest-winners" uri

 

} elseif {([string tolower [HTTP::path]] contains "/connect/beachbody-challenge/vote/quarterly") } { incr invoke regsub "/connect/beachbody-challenge/vote/quarterly" $uri "/beachbody-challenge/vote/quarterly" uri

 

} elseif {([string tolower [HTTP::path]] contains "/connect/beachbody-challenge") } { incr invoke regsub "/connect/beachbody-challenge" $uri "/beachbody-challenge" uri }

 

if {($invoke == 1)} {
    HTTP::respond 301 Location https://[HTTP::host]$uri
}

}

 

application delivery
devops
iRules
LTM

3 Replies

  • Michael_Jenkins's avatar
    Michael_Jenkins
    Icon for Cirrostratus rankCirrostratus
    Feb 23, 2015

    From the error message you're mentioning, that generally means there's multiple locations that are executing an 

    HTTP::respond
    (or 
    HTTP::redirect
    ). Do you have other iRules associated that are doing any redirects as well? This happens because the iRules don't stop processing when the respond command executes.

    Also, concerning your iRule, regex expressions are expensive (and you should use a variable instead of reusing the 

    string tolower
    command), so minimizing their usage is ideal. Perhaps updating your iRule to use something like this may help:

    when HTTP_REQUEST {

    set uri [string tolower [HTTP::uri]]
    set invoke 0

    switch -glob -- $uri {
        "*/connect/beachbody-challenge/pledge*" {
            incr invoke 
            set newUri [string map -nocase {/connect/beachbody-challenge/pledge /beachbody-challenge/participate-commit-now"} $uri]
        }
        "*/connect/beachbody-challenge/entry*" { 
            incr invoke 
            set newUri [string map -nocase {/connect/beachbody-challenge/entry /beachbody-challenge/enter-contest"} $uri]   
        }
        "*/connect/beachbody-challenge/winners-monthly*" { 
            incr invoke 
            set newUri [string map -nocase {/connect/beachbody-challenge/winners-monthly /beachbody-challenge/contest-info-and-contest-winners"} $uri]
        }
        "*/connect/beachbody-challenge/winners-quarterly*" {
            incr invoke 
            set newUri [string map -nocase {/connect/beachbody-challenge/winners-quarterly /beachbody-challenge/contest-info-and-contest-winners"} $uri]
        }
        "*/connect/beachbody-challenge/winners-final*" {
            incr invoke 
            set newUri [string map -nocase {/connect/beachbody-challenge/winners-final /beachbody-challenge/contest-info-and-contest-winners"} $uri]
        }
        "*/connect/beachbody-challenge/vote/quarterly*" {
            incr invoke 
            set newUri [string map -nocase {/connect/beachbody-challenge/vote/quarterly /beachbody-challenge/vote/quarterly"} $uri]
        }
        "*/connect/beachbody-challenge*" { 
            incr invoke 
            set newUri [string map -nocase {/connect/beachbody-challenge /beachbody-challenge"} $uri]
        }
    }

    if {$invoke} {
        HTTP::respond 301 Location https://[HTTP::host]$newUri Connection Close
         This will ensure other events don't fire, and your response will cause a new connection (so that the next request will execute all desired events)
        event disable all
        return
    }
}
  • William_Franz_1's avatar
    William_Franz_1
    Icon for Nimbostratus rankNimbostratus
    Feb 23, 2015

    Thanks for the response Michael.

     

    After I researched it here on the forums I figured that may be the the problem, so I thought I would ask just to be sure. The problem is there are 40 iRules on this one VIP because the programers use iRules to address code issues instead of addressing the code itself. I moved this specific rule to the bottom but that did not work but I think I may have found an iRule that is the root of the problem.

     

    Thanks for the pointers on the iRule as i will keep that in mind moving forward.

     

    • Michael_Jenkins's avatar
      Michael_Jenkins
      Icon for Cirrostratus rankCirrostratus
      Feb 23, 2015
      No problem. With that many iRules attached, I'd recommend looking into the event command (https://devcentral.f5.com/s/articles/irules-disabling-event-processing). There may be some caveats to it, but in my experience so far, it makes things a lot simpler, since it's the only way I know to stop further processing on the rule event(s). And if you find the answer is good, you can mark it as the solution so others can see it's answered.