For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

craff_17758's avatar
craff_17758
Historic F5 Account
Sep 25, 2007

iRule stopped working with upgrade to 9.4.1

All,

I've been going over this iRule for a while, and I don't see what broke.

This iRule worked in version 9.2.3, but stopped doing its job in 9.4.1. The purpose of the rule is to translate filename extensions in requests and re-translate them on the way back out. (The middle part for selecting a pool reputedly works fine.)

Did something change in the implementation of the TCL 'string map' implementation?

rule Open_Redirect {
   when HTTP_REQUEST {
set uri [HTTP::uri]
log local0. "greg test 1"
if { [string tolower [HTTP::uri]] contains ".osp" } {
replace remote_addr with .ospx -> .aspx and .osp -> .asp
set uri [string map -nocase {.ospx .aspx .osp .asp} $uri]
Set target uri to the version after the replaces have been run
HTTP::uri $uri
}
if { [string tolower [HTTP::uri]] contains "server72" } {
            persist none
            use pool Delphi-Apps_Server72
   } elseif { [string tolower [HTTP::uri] ] contains "server75" } {
            persist none
            log local0. "Server 75"
            use pool Delphi-Apps_Server75
        } elseif { [string tolower [HTTP::uri] ] starts_with "/apps/reportengine" 
or [string tolower [HTTP::uri] ] starts_with "/crystalreportviewers115" 
or [string tolower [HTTP::uri] ] starts_with "/apps/crbroker" } {  
            use pool Delphi-Apps_Server72
        } elseif { [string tolower [HTTP::uri] ] starts_with "/apps" 
or [string tolower [HTTP::uri] ] starts_with "/crystalreportviewers11" 
or [string tolower [HTTP::uri] ] starts_with "/businessobjects" 
or [string tolower [HTTP::uri] ] starts_with "/leaseadmin" 
or [string tolower [HTTP::uri] ] starts_with "/resources/apps/portfoliotracker" } {
            use pool Delphi-Apps
        } elseif {  [string tolower [HTTP::uri] ] starts_with "/redsau" 
or [string tolower [HTTP::uri] ] starts_with "/resources/apps/reportengine" 
or [string tolower [HTTP::uri] ] starts_with "/crystalreportviewers10" } { 
            use pool DelphiAppStage  
        } elseif { [string tolower [HTTP::uri] ] contains "server85" or [HTTP::cookie exists "cookie85"]} {
            persist none
            use pool Delphi_Portal_Server85
} elseif { [string tolower [HTTP::uri]] contains "server10" } {
           persist none
           use pool Delphi_Portal_Server10
        } elseif { [string tolower [HTTP::uri] ] contains "server14" } {
            persist none
            log local0. "Server 14"
            use pool Delphi_Portal_Server14
   } else
{
            use pool Delphi-Portal
        }
    }
when HTTP_RESPONSE {
          log local0. "gregtest1"
set location [HTTP::header value Location]
          log local0. "OPEN: Location-> $location"
HTTP::header replace Location [string map -nocase {2easpx 2eospx .aspx .ospx .asp .osp delphilil.am open.am} [HTTP::header value Location]]
          STREAM::enable
          STREAM::expression "@\\.asp@.osp@ @\\.aspx@.ospx@ @delphilil\\.am@open.am@"
}
}
application delivery
dev
devops
iRules

5 Replies

  • Colin_Walker_12's avatar
    Colin_Walker_12
    Historic F5 Account
    Sep 26, 2007
    As far as I know, the string map command hasn't changed. When you say it broke, what do you mean exactly? If you could provide some more detail about how it's failing or what part stopped working, it might give us a place to start looking.

     

     

    Thanks,

     

    Colin
  • Deb_Allen_18's avatar
    Deb_Allen_18
    Historic F5 Account
    Sep 26, 2007
    We've seen a few reports from the field recently that iRules that worked fine prior break upon upgrading to 9.4.1., and the problem seems related to a change in the iRules parser.

     

     

    This doesn't appear to map directly to any of the reports I've seen, so I'd recommend opening a Support case to work through it.

     

     

    I'd be interested in knowing the case so the DevCentral team can help define this difficult-to-isolate issue and correct it ASAP.

     

     

    /deb

     

     

  • craff_17758's avatar
    craff_17758
    Historic F5 Account
    Oct 01, 2007
    I have more information, thanks to a reproduction that I put together. I stripped out the pool selection parts, and just focussed on the translation parts.

     

     

    I put a file named test.aspx on an internal web server, and pointed a virtual server at it with the iRule applied.

     

     

    When I requested test.aspx from the webserver, it is returned as we would expect.

     

     

    If I request test.ospx from the virtual server, I get a 404 Not Found from the Web Server.

     

     

    If I request test.aspx from the virtual server, I get the page with all the aspx translated to ospx

     

     

    So it would appear that STREAM::expression works just fine. What is broken is this part:

     

     

    when HTTP_REQUEST {

     

    set uri [HTTP::uri]

     

    if { [string tolower [HTTP::uri]] contains ".osp" } {

     

    replace remote_addr with .ospx -> .aspx and .osp -> .asp

     

    set uri [string map -nocase {.ospx .aspx .osp .asp} $uri]

     

     

    Set target uri to the version after the replaces have been run

     

    HTTP::uri $uri

     

    }

     

     

    }

     

     

  • Deb_Allen_18's avatar
    Deb_Allen_18
    Historic F5 Account
    Oct 01, 2007
    Logging "before" & "after" values is the recommended troubleshooting approach for failed replacement operations.

    Give this a shot:

    when HTTP_REQUEST {
  log local0. "URI before: [HTTP::uri]"
  if {[string tolower [HTTP::uri]] contains ".osp" }{
     replace .ospx w/ .aspx & .osp w/ .asp
    set uri [string map -nocase {.ospx .aspx .osp .asp} $uri]
    log local0. "URI after: $uri"
     re-write post replacement URI
    HTTP::uri $uri
  }
}

    That should make it more obvious whether the string map is replacing as expected.

    HTH

    /deb