For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Emad's avatar
Emad
Icon for Cirrostratus rankCirrostratus
May 08, 2014

Issue in HTTP to HTTPS redirect

I have implemented Irule to redirect http to https. It seems to be working fine but i am getting TCL errors in ltm log.

i.e

Operation not supported. Multiple redirect/respond invocations not allowed

err tmm[8151]: 01220001:3: TCL error: /Common/_sys_https_redirect - Operation not supported. Multiple redirect/res pond invocations not allowed (line 3) invoked from within "HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]"

list ltm rule _sys_https_redirect 
ltm rule _sys_https_redirect {
    nodelete nowrite 
when HTTP_REQUEST {
       HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
    }
}
application delivery
devops
iRules
LTM

3 Replies

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    May 08, 2014

    Can I assume that you have other iRules applied to this VIP, and that they too contain redirects?

     

  • Emad's avatar
    Emad
    Icon for Cirrostratus rankCirrostratus
    May 08, 2014

    No, but class profiles are attached, one is of ASM security Policy and for redirection.

    i.e

    ltm profile httpclass redirect_site{
    app-service none
    defaults-from httpclass
    hosts { glob:www.site.com glob:site.com }
    pool dmz_apache_pool
    redirect none
}
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    May 08, 2014

    Your class profile isn't technically a redirect, but it may be interfering with the logic of the iRule nonetheless. So based on the iRule you're using, you have an HTTP VIP and an HTTPS VIP. By virtue of the iRule, ANY request to the HTTP VIP will be redirected to the HTTPS VIP. So if you apply the HTTPS redirect iRule ONLY to the HTTP VIP, and the class profile ONLY to the HTTPS VIP, then you shouldn't have any conflicts.