For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

15 Replies

  • It isn't working because you are trying to compare the HTTP::host string to a full location (host + URI). Change your iRule to look like this:

    when HTTP_REQUEST { 
     if {[string tolower [HTTP::host]] equals "wcp.xx.com" and [string tolower [HTTP::uri]] starts_with "/wxx" } { 
      HTTP::redirect "https://pushdev.xx.com/[HTTP::uri]" 
      } 
    }
    
    • iraheel_135195's avatar
      iraheel_135195
      Icon for Nimbostratus rankNimbostratus
      Perfect thanks it works fine , is it possible i can do the URL masking with this ? So users can always see wcp.xx.com\wxx on the address bar
    • PK_Bhatia's avatar
      PK_Bhatia
      Icon for Nimbostratus rankNimbostratus
      you can use proxy pass for this ... https://clouddocs.f5.com/api/irules/proxypassv10.html
    • iraheel_135195's avatar
      iraheel_135195
      Icon for Nimbostratus rankNimbostratus
      wow seems like i have to do some reading , is there any easier way ? Can i simply use an else command with the code above
  • is it possible i can do the URL masking with this ? So users can always see wcp.xx.com\wxx on the address bar

     

    if you do not want to change display url in browser, you can use HTTP::header and/or HTTP::uri to change HTTP header (e.g. host header) and URI when sending request to pool member.

     

    • iraheel_135195's avatar
      iraheel_135195
      Icon for Nimbostratus rankNimbostratus
      when HTTP_REQUEST { So where do i have to change the header in place of uri if {[string tolower [HTTP::host]] equals "wcp.xx.com" and [string tolower [HTTP::uri]] starts_with "/wxx" } { HTTP::redirect "https://pushdev.xx.com/[HTTP::uri]" } }
  • is it possible i can do the URL masking with this ? So users can always see wcp.xx.com\wxx on the address bar

     

    if you do not want to change display url in browser, you can use HTTP::header and/or HTTP::uri to change HTTP header (e.g. host header) and URI when sending request to pool member.

     

    • iraheel_135195's avatar
      iraheel_135195
      Icon for Nimbostratus rankNimbostratus
      when HTTP_REQUEST { So where do i have to change the header in place of uri if {[string tolower [HTTP::host]] equals "wcp.xx.com" and [string tolower [HTTP::uri]] starts_with "/wxx" } { HTTP::redirect "https://pushdev.xx.com/[HTTP::uri]" } }
  • e.g.

     config
    
    root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm virtual bar
    ltm virtual bar {
        destination 172.28.24.10:80
        ip-protocol tcp
        mask 255.255.255.255
        pool foo
        profiles {
            http { }
            tcp { }
        }
        rules {
            qux
        }
        source 0.0.0.0/0
        source-address-translation {
            type automap
        }
        vs-index 2
    }
    root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm pool foo
    ltm pool foo {
        members {
            200.200.200.101:80 {
                address 200.200.200.101
            }
        }
    }
    root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm rule qux
    ltm rule qux {
        when HTTP_REQUEST {
      if { [string tolower [HTTP::host]] eq "wcp.xx.com" and [string tolower [HTTP::path]] starts_with "/wxx" } {
        HTTP::header replace Host "pushdev.xx.com"
        HTTP::uri [string map {/wxx/ /} [HTTP::uri]]
      }
    }
    }
    
     trace
    
    [root@ve11a:Active:In Sync] config  ssldump -Aed -nni 0.0 port 80
    New TCP connection 1: 172.28.24.4(58847) <-> 172.28.24.10(80)
    1397589044.7888 (0.0015)  C>S
    ---------------------------------------------------------------
    GET /wxx/something HTTP/1.1
    User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
    Accept: */*
    Host: wcp.xx.com
    
    ---------------------------------------------------------------
    
    New TCP connection 2: 200.200.200.14(58847) <-> 200.200.200.101(80)
    1397589044.7908 (0.0019)  C>S
    ---------------------------------------------------------------
    GET /something HTTP/1.1
    User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
    Accept: */*
    Host: pushdev.xx.com
    
    ---------------------------------------------------------------
    
    • iraheel_135195's avatar
      iraheel_135195
      Icon for Nimbostratus rankNimbostratus
      thats didnt worked:( when HTTP_REQUEST { if { [string tolower [HTTP::host]] eq "wcp.xx.com" and [string tolower [HTTP::path]] starts_with "/wxx" } { HTTP::header replace Host "pushdev.xx.com" HTTP::uri [string map {/wxx/ /} [HTTP::uri]] } }
  • e.g.

     config
    
    root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm virtual bar
    ltm virtual bar {
        destination 172.28.24.10:80
        ip-protocol tcp
        mask 255.255.255.255
        pool foo
        profiles {
            http { }
            tcp { }
        }
        rules {
            qux
        }
        source 0.0.0.0/0
        source-address-translation {
            type automap
        }
        vs-index 2
    }
    root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm pool foo
    ltm pool foo {
        members {
            200.200.200.101:80 {
                address 200.200.200.101
            }
        }
    }
    root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm rule qux
    ltm rule qux {
        when HTTP_REQUEST {
      if { [string tolower [HTTP::host]] eq "wcp.xx.com" and [string tolower [HTTP::path]] starts_with "/wxx" } {
        HTTP::header replace Host "pushdev.xx.com"
        HTTP::uri [string map {/wxx/ /} [HTTP::uri]]
      }
    }
    }
    
     trace
    
    [root@ve11a:Active:In Sync] config  ssldump -Aed -nni 0.0 port 80
    New TCP connection 1: 172.28.24.4(58847) <-> 172.28.24.10(80)
    1397589044.7888 (0.0015)  C>S
    ---------------------------------------------------------------
    GET /wxx/something HTTP/1.1
    User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
    Accept: */*
    Host: wcp.xx.com
    
    ---------------------------------------------------------------
    
    New TCP connection 2: 200.200.200.14(58847) <-> 200.200.200.101(80)
    1397589044.7908 (0.0019)  C>S
    ---------------------------------------------------------------
    GET /something HTTP/1.1
    User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
    Accept: */*
    Host: pushdev.xx.com
    
    ---------------------------------------------------------------
    
    • iraheel_135195's avatar
      iraheel_135195
      Icon for Nimbostratus rankNimbostratus
      thats didnt worked:( when HTTP_REQUEST { if { [string tolower [HTTP::host]] eq "wcp.xx.com" and [string tolower [HTTP::path]] starts_with "/wxx" } { HTTP::header replace Host "pushdev.xx.com" HTTP::uri [string map {/wxx/ /} [HTTP::uri]] } }