For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jeff_parten_106's avatar
jeff_parten_106
Icon for Nimbostratus rankNimbostratus
Nov 27, 2006

many to one uri redirect

Good day to all,

 

If someone could please point me in the correct direction, it would be greatly appreciated.

 

 

We have over 100 domain names all pointing to one address (e.g., sleepingbeauty.com, monstersinc.org, pinocchio.com, dubo.net etc. all go to 192.168.10.50), the main domain name is www.disney.com pointing to the same address of 192.168.10.50. www.disney.com also has a SSL certificate which the bigip is redirecting all http connections to https. (this works fine)

 

 

We have been taskted to redirect all domain names that go the the web server to www.disney.com. Below is one of the scripts we were testing.

 

 

when HTTP_REQUEST {

 

if { not ([HTTP::uri] matches "www.disney.com") } {

 

HTTP::redirect http://www.disney.com

 

}

 

 

Any ideas?

 

Thanks

 

J.
application delivery
dev
devops
iRules

4 Replies

  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Nov 27, 2006
    You probably want [HTTP::host] instead of [HTTP::uri]
  • jeff_parten_106's avatar
    jeff_parten_106
    Icon for Nimbostratus rankNimbostratus
    Nov 27, 2006
    I tried to just get the redirect working with this script below using the [HTTP::host] and received a page can not be displayed error

     

     

    when HTTP_REQUEST {

     

    if { [HTTP::host] contains "pinocchio.com" } {

     

    HTTP::redirect "http://www.disney.com"

     

    }

     

    }

     

     

    Thanks again,

     

    J.
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Nov 28, 2006
    Hello,

    Can you explain in more detail what you are trying to do? It sounds like you have two VIPs on the same IP address: one on :80 and one on :443? Which VIP are you applying the redirect rule to?

    If you're apply it to the HTTP VIP, it should work without any issues, redirecting all requests to pinocchio.com to http://www.disney.com.

    If you're applying it to the HTTPS VIP, the client would be making a request to www.pinocchio.com but get the SSL cert for www.disney.com presented. This would cause a hostname mismatch error and generate a prompt to accept the cert by the browser.

    To get a better idea of what's happening, try adding a logging statement to the rule. You may also want to set the host header value to lower case if the client could send a request in mixed case:

    
when HTTP_REQUEST {
   log local0. "client [IP::client_addr] requested [HTTP::host][HTTP::uri]"
   if { [string tolower [HTTP::host]] contains "pinocchio.com" } {
      HTTP::redirect "http://www.disney.com"
   }
}

    Aaron
  • jeff_parten_106's avatar
    jeff_parten_106
    Icon for Nimbostratus rankNimbostratus
    Nov 29, 2006
    I do appreciate your suggestions Aron. I was however able to get the redirect working with the iRule below. One of the problems I was having is I had two redirects attached to the same virtual server. I found by looking at the /var/log/ltm logs you can only have one per virtual server. So I combined the http to https and the many to one in one iRules. I called the iRule:

     

     

    "not_https_www.disney.com" and assigned it to the Disney virtual server

     

     

    when HTTP_REQUEST {

     

    if { not ([HTTP::host] equals "www.disney.com") } {

     

    HTTP::redirect "https://www.disney.com"

     

    } else {

     

    HTTP::redirect "https://[HTTP::host][HTTP::uri]"

     

    }

     

    }

     

    I do thank you again.

     

    J.