For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

royceking_18057's avatar
royceking_18057
Icon for Cirrus rankCirrus
Jan 23, 2015

Operation not supported (line 5) invoked from within "HTTP::header insert

I am passing the client-ip in a header with the name client-ip with the following iRule. 

when HTTP_REQUEST {
   Strip off the %n route domain notation from the client IP address
   and insert it into a custom HTTP header named client-ip
  HTTP::header insert client-ip [getfield [IP::client_addr] "%" 1]
}

This is working great for me since my application is looking for the header with the name client-ip. However, my syslogs are getting pounded with the following error: 

 - Operation not supported (line 5)     invoked from within "HTTP::header insert client-ip [getfield [IP::client_addr] "%" 1]

From things that I have read it sounds like it is throwing this because the request is getting redirected from another iRule ahead of this. This is most likely the case. How do I make things play nicely with each other? I need the redirects and the header insert.

application delivery
devops
iRules
LTM

2 Replies

  • Michael_Jenkins's avatar
    Michael_Jenkins
    Icon for Cirrostratus rankCirrostratus
    Jan 23, 2015

    I think what you need to do is make sure that the redirect happens after setting the header. If that's not possible, on your redirect you could do something like this instead

    HTTP::respond 301 Location "url here" "Connection" "Close"
event disable all

    This would keep any further iRules from executing. As I understand, the reason you would get this message is because you've already started a response to the client, so the request will not be going to the backend server, and shouldn't be modified anymore.

    Another option would be to set a flag if you've done a redirect and then check the flag in other irules and skip them if you have set a redirect, but to me, that's kinda inefficient, which is why I use the event disable command and send the close connection header (the event disable stays that way for the connection lifetime). And when you do an HTTP::respond or HTTP::redirect, you don't get the HTTP_RESPONSE event fired, so you can't reenable the events.

    Hope this helps.