For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

brianokelly_119's avatar
brianokelly_119
Icon for Nimbostratus rankNimbostratus
Mar 03, 2011

iRule to serve image to user

Hi All,

We are trying to serve a 1MB image directly from a specific uri on a vip to test throughput up to the F5. As such we do not wish to put the base 64 encoded image data into the bigip.conf file, rather store it on the file system. I followed an example on the site but it does not seem to work (v10.2 on an 8900):

Class:
class logo_f5_class_t2 {

   "filename" { "/var/class/f5.image.class" }
}



iRule:
when HTTP_REQUEST {

    if {[HTTP::uri] eq "/preprodtestimage/image.jpg" }

                {

            HTTP::respond 200 content [b64decode [lindex $::logo_f5_class_t2 0]] "Content-Type" "image/jpg"

                } 

   }

When loading the image directly in the response (b64 encoded) we have no issues. However, when we use the above we get page could not be displayed. Can anyone see anything obvious missing?

application delivery
dev
devops
iRules

4 Replies

  • George_Watkins_'s avatar
    George_Watkins_
    Historic F5 Account
    Mar 04, 2011
    Hi,

     

     

    It probably isn't such a good idea to serve up a 1MB image directly from the BIG-IP for a couple of reasons. The first being that TMM can only handle 4MB of data before it will intentionally restart itself. This is to prevent potential swapping to disk as well as interference with other tasks the BIG-IP may be performing. Secondly, for security reasons iRules do not have direct access to the filesystem. If you want to serve up a base64 encoded image from the BIG-IP, the data will either need to be included in the iRule itself or a datagroup. Both of which will reside inside of bigip.conf. If I were in your position, I would spin up an Apache server on a cheap piece of hardware and just use an iRule to send users there.

     

     

    -George
  • brianokelly_119's avatar
    brianokelly_119
    Icon for Nimbostratus rankNimbostratus
    Mar 06, 2011
    Hi George,

     

     

    Thanks for the response. The iRule cannot access the file system directly, however the following article:

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/LTMMaintenancePage.html

     

     

     

    describes how to use a class to store the image on disk. The iRule simply calls the class. This iRule will not be used in production, it is only to clarify throughput up to the F5 to verify the perimeter firewall and IPS are capable of operating at the designed throughput.

     

     

    Brian

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Mar 08, 2011
    In 10.x, you can no longer access a datagroup directly as a TCL list. You can change [lindex $::class_name 0] to [class element -name 0 class_name].

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/class

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/CMPCompatibility.html

     

     

    Aaron
  • brianokelly_119's avatar
    brianokelly_119
    Icon for Nimbostratus rankNimbostratus
    Mar 08, 2011
    Hi hoolio,

    I modified to the following: 

    

class logo_f5_class_t2 {
   "filename" { "/var/class/f5.image.class" }
}

rule TEST_IMG_t2 {
   when HTTP_REQUEST {
    if {[HTTP::uri] eq "/testimage/image.png" }
                {
           HTTP::respond 200 content [b64decode [class element -value 0 logo_f5_class_t2]] "Content-Type" "image/png"
                }
   }
}

    however I still see the following error in the log: 

    

Mar  9 11:52:41 local/tmm6 err tmm6[6612]: 01220001:3: TCL error: TEST_IMG_t2  - conversion error     invoked from within "b64decode [class element -value 0 logo_f5_class_t2]"

    The f5.image.class contains the following with no new lines (I used :%s/\n//g to remove new lines): 

    

"R0lGODlhEgAeANUAABAREz9CSEBBQz0+QB8hJCIkJ5eZnGJlaXN2egQJDwUKEDo+Q0VJTgEDBQULEQUKDwMGCTo+Qk1RVUtPU0pOUk9TV1RYXFZaXlxgZFtfYy0vMRcYGTEzNR8gIW5xdG1wc2lsb2hrbklLTXh7fnV4e3R3enN2eXF0d4SHiqCipJeZmwQKDwULEDU6PktQVFtfYjI4PHN2eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwAAAAAEgAeAEAG20CRcEgsDjFIZGa5fDmTSId0Sq2yroqsdsvVnr5fk9gUK8fAX4Z6zW6vu3Duak6v2+mIfH7E7/P1eSGsDjFIZGa5fDmTSId0Sq2yroqsdsvVnr5fk9gUK8fAX4Z6zW6vu3Duak6v2+CggMdIIWHHYOCsDjFIZGa5fDmTSId0Sq2yroqsdsvVnr5fk9gUK8fAX4Z6zW6vu3Duak6v2+FY2NGhsSkJIbjsDjFIZGa5fDmTSId0Sq2yroqsdsvVnr5fk9gUK8fAX4Z6zW6vu3Duak6v2+o0RmJgEAC2bnQsDjFIZGa5fDmTSId0Sq2yroqsdsvVnr5fk9gUK8fAX4Z6zW6vu3Duak6v2+CZmFUuEA6kpqUsDjFIZGa5fDmTSId0Sq2yroqsdsvVnr5fk9gUK8fAX4Z6zW6vu3Duak6v2+OVyxcExAKrrCvsDjFIZGa5fDmTSId0Sq2yroqsdsvVnr5fk9gUK8fAX4Z6zW6vu3Duak6v2+W3auK7a2dSm7vL2+vCXBwSTExcTCwR/KygYCHs0eKgLLygfW19jZ1xfc3CgcFt/hHN3cFOfo6eroAe3tJwU7vL2+L8PIF7u0w+Pn6+/lV/lSruEBooGBgQYJxEio0yBChlgcQI0qcGPGORTsJMmrcyFFjEA7vL2+A7",

    Brian