For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jonm_62062's avatar
jonm_62062
Icon for Nimbostratus rankNimbostratus
Jan 07, 2011

ProxyPass iRule, Version 8.2 usage

I'm trying to implement ProxyPass iRule, Version 8.2 so I can remove apache from a server . The apache code does nothing accept 'proxypass' to another app on the same server . Here is the proxy pass statement in the httpd.conf file

 

 

ProxyPass /LogToolDEV/ http://localhost:8080/

 

 

Currently the user connects to this app using a url like this

 

 

https://some.server.something/LogToolDEV

 

 

The bigip terminates the ssl and I currently have a simple irule that looks for the 'LogToolDEV' and changes the pool to 'test' (port 80) on which apache is listening .

 

This works fine.

 

 

So it seems as though I can bypass apache all together with the ProxyPass irule . I

 

have tried various combinations in the irule data group , here are 2

 

 

/LogToolDEV/ http://192.168.12.96:8080/ test8080

 

/LogToolDEV/ / test8080

 

 

the pool test8080 point to the server , port 8080

 

 

I have verified the existence of pool 'test8080' but irule debug shows

 

 

Jan 7 10:34:04 tmm tmm[1667]: Rule ProxyPasscnedev : some_virtualname, Host=some.server.something, URI=/LogToolDEV/: Found Rule, Client Host=some.server.something, Client Path=/LogToolDEV, Server Host=some.server.something, Server Path=

 

Jan 7 10:34:04 tmm tmm[1667]: 01220001:3: TCL error: ProxyPasscnedev - no such pool Failed Tcl_pool_GetFromObj: pool (line 201) invoked from within "pool $newpool"

 

 

What am I missing ?

 

application delivery
dev
devops
iRules

19 Replies

  • Steve_Brown_882's avatar
    Steve_Brown_882
    Historic F5 Account
    Jan 07, 2011
    That error looks like it can't find the actual pool. Can you paste the irule in?
  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Jan 07, 2011
    Looks like the "newpool" variable hasn't been set properly. As stjbrown said, code would be helpful.
  • jonm_62062's avatar
    jonm_62062
    Icon for Nimbostratus rankNimbostratus
    Jan 07, 2011
    http://devcentral.f5.com/wiki/default.aspx/iRules/ProxyPass.html with no mods

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jan 07, 2011
    Which LTM version are you running? If you're on 10.x, you should use the updated ProxyPass iRule:

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/ProxyPassV10.html

     

     

    ProxyPasss v8.2 will only work with 9.x.

     

     

    Else, if you're on 9.x, make sure you have a pool named test8080 defined.

     

     

    Aaron
  • jonm_62062's avatar
    jonm_62062
    Icon for Nimbostratus rankNimbostratus
    Jan 07, 2011
    the vs has a default pool defined

     

    test8080 is defined

     

    BIG-IP 9.4.7 Build 320.1 Final
  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Jan 07, 2011
    Can you add additional logging to this part? 

    
  } else {
            pool $newpool
            if { $::ProxyPassDebug > 0 } {
               log local0. "$log_prefix: Using parsed pool $newpool"
            }

    change it to this: 

    
  } else {
           log local0. "newpool is set to $newpool"
            pool $newpool
            if { $::ProxyPassDebug > 0 } {
               log local0. "$log_prefix: Using parsed pool $newpool"
            }
  • jonm_62062's avatar
    jonm_62062
    Icon for Nimbostratus rankNimbostratus
    Jan 07, 2011
    that shows in the ltm log

     

     

    newpool is set to http://192.168.12.96:8080/
  • jonm_62062's avatar
    jonm_62062
    Icon for Nimbostratus rankNimbostratus
    Jan 07, 2011
    further such code shows

     

     

    Jan 7 12:10:53 tmm tmm[1667]: Rule ProxyPasscnedev : clientside is set to /LogToolDEV/

     

    Jan 7 12:10:53 tmm tmm[1667]: Rule ProxyPasscnedev : serverside is set to

     

    Jan 7 12:10:53 tmm tmm[1667]: Rule ProxyPasscnedev : newpool is set to http://192.168.12.96:8080/

     

     

    so why is

     

     

    set serverside [getfield $ppass " " 2]

     

     

    failing ?

     

     

    I changed the server side entry in the irule data group list to just / with the same result

     

    to /xyz/ with same result

     

    to xyz with same result
  • jonm_62062's avatar
    jonm_62062
    Icon for Nimbostratus rankNimbostratus
    Jan 07, 2011
    checking ppass shows

     

     

    ppass is set to /LogToolDEV/ xyz test8080

     

     

    so wtf ?