For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

samdlee_305622's avatar
samdlee_305622
Icon for Nimbostratus rankNimbostratus
Mar 24, 2017

iRule is called many times for the same multipart/form-data form post

Hei, I've encountered a very confusing situation where a web form tries to upload a file together with some other info. In iRule associated with HTTP_REQUEST replaced the original HOST header with another string, bm-dev.mycompany.com/bm before calling "pool openshift3_infra". Although it works well for both Chrome and Firefox, the strange thing here is that the same iRule has been triggered many times before it finally reached the converned pool member. For instance, the worst situations is that the iRule is triggered 5 times (see loggings from LTM in my comments below due to limitation of words of question description) It'll be great if someone can shed the light on why it happens in this way.

Configurations for VS:

 

 ltm virtual /Common/https_test {
 description "[Internal] Test/Dev/Beta/Uat-apps"
 destination /Common/1xx.xxx.xxx:443
 fallback-persistence /Common/source_addr
 ip-protocol tcp
 mask 255.255.255.255
 persist {
     /Common/cookie {
         default yes
     }
 }
 profiles {
     /Common/http { }
     /Common/serverssl {
         context serverside
     }
     /Common/tcp { }
     /Common/wildcard.mycompany.no {
         context clientside
     }
 }
 rules {
     /Common/log_HSL_beta
     /Common/https_test_pool_select_v2
     /Common/encrypt_cookie
     /Common/strip_headers_inv_beta
     /Common/error_message_v2.1
     /Common/secure_cookie
     /Common/disable_track_trace
     /Common/response-handler-investor
     /Common/common-cleansession
 }
 source 0.0.0.0/0
 source-address-translation {
     type automap
 }
 translate-address enabled
 translate-port enabled
 }

 

Thanks in advance!

devops
iRules
LTM

3 Replies

  • Soda_Cup_148395's avatar
    Soda_Cup_148395
    Icon for Nimbostratus rankNimbostratus
    Mar 24, 2017

    unless you have the oneconnect profile applied than each iRule will only be process once per TCP connection.

     

  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Mar 24, 2017

    iRule is event based scripting. For example, "when HTTP_REQUEST" indicates that the iRule will be triggered whenever an HTTP Request is received by the F5 from the client. Based on the logs that you provided, you seem to be logging a lot of information like individual HTTP headers. This logging does not indicate the number of times the iRule is triggered. You can look for the number of times an iRule is executed under the iRule statistics.

     

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Mar 27, 2017

    Hi Samdlee,

    keep an eyee on the TMM ID record of the individual log entries. Its flipping between TMM, TMM1, TMM2 as well as TMM3. This will indicate that you see at least 4 independent TCP connections and not a single request that triggers the iRule code multiple times.

    I would recommend to extend the label "1xx.my.ip.addr" with TCP::client_port] or to generate a collision free connection ID via set conn_id "[clock clicks][TMM::cmp_unit]" during the CLIENT_ACCEPTED event and then add this connection ID to your logging statements ...

    Cheers, Kai