For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Chadri_103513's avatar
Chadri_103513
Icon for Nimbostratus rankNimbostratus
Jun 14, 2010

set command broken by "//"

Hello,

 

 

I'm having an issue with one of my iRules and I wanted to see if anybody has run into this issue in the past. Basically, I have an iRule that inspects the URI for a set of commands and assigns a variable value in the process for further inspection. The issue that I have run into is that when a full URL is passed within the URI (referredby=http://www.abc.com for example), it breaks my iRule by not allowing the variable to be set. This appears to be specifically related to the "//" in the URI. Is there a way to force an iRule to ignore this string?

 

 

Here is the portion of the iRule that is breaking:

 

 

if { [HTTP::method] eq "GET"} {

 

set cmd [ URI::query [string tolower [HTTP::uri]] command ]

 

log local0. "Debug - command = '$cmd'"

 

 

When I look at the logs, I notice that if I issue the following command the iRule does not set the command:

 

 

http://testURL/interface.asp?command=createaccount&referredby=http://www.abc.com

 

Jun 14 15:32:09 tmm tmm[1717]: Rule test-80 HTTP_REQUEST : Debug - command = ''

 

 

But if I remove the "//", it works:

 

http://testURL/interface.asp?command=createaccount&referredby=http:www.abc.com

 

Jun 14 15:32:21 tmm tmm[1717]: Rule test-80 HTTP_REQUEST : Debug - command = 'createaccount'

 

 

Thanks in advance for your assistance.

 

 

Chris

 

application delivery
dev
devops
iRules

10 Replies

  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Jun 15, 2010
    What does throwing quotes around that area do?

     

     

    if { [HTTP::method] eq "GET"} {

     

    set cmd "[ URI::query [string tolower [HTTP::uri]] command ]"

     

    log local0. "Debug - command = '$cmd'"

     

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jun 15, 2010
    Hi Chris,

    Which LTM version are you testing this on? For 10.2.0, it seems to work as expected: 

    when RULE_INIT {
   set url {http:// testURL/interface.asp?command=createaccount&referredby=http: //www.abc.com}
   log local0. "\[URI::query $url command\]: [URI::query $url command]"

   set url {http:// testURL/interface.asp?command=createaccount&referredby=http://www.abc.com}
   log local0. "\[URI::query $url command\]: [URI::query $url command]"
}

    < RULE_INIT >: [URI::query http:// testURL/interface.asp?command=createaccount&referredby=http:// www.abc.com command]: createaccount

    < RULE_INIT >: [URI::query http:// testURL/interface.asp?command=createaccount&referredby=http:www.abc.com command]: createaccount

    Saving the value to a variable also returns the expected value for $command:

    
   set url {http:// testURL/interface.asp?command=createaccount&referredby=http:// www.abc.com}
   set command [URI::query $url command]
   log local0. "\[URI::query $url command\]: $command"
   set url {http:// testURL/interface.asp?command=createaccount&referredby=http:www.abc.com}
   set command [URI::query $url command]
   log local0. "\[URI::query $url command\]: $command"

    (I added spaces after each http:// instance to prevent the forums from autolinking the URLs)

    Also, the query string should be case sensitive, so you shouldn't need to set it to lowercase. The path in IIS is not case sensitive, so if you're checking the file the request is made to you'd want to set just the path to lower case.

    Aaron
  • Chadri_103513's avatar
    Chadri_103513
    Icon for Nimbostratus rankNimbostratus
    Jun 15, 2010
    Aaron,

     

     

    I'm running 10.0.1 HF3 on that device. The actual string that is passed is much longer, but it appears that the "//" is what is causing the issues. When it is removed the command is passes with no problem. The actual iRule is also much longer, however, the variable is set up at the top and I'm not sure if something else in the iRule could be messing that up. Is "//" some sort of escape sequence and if so, can it be ignored?

     

     

    Chris
  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Jun 15, 2010
    Posted By Chadri on 06/15/2010 10:34 AM

     

    Aaron,

     

     

    I'm running 10.0.1 HF3 on that device. The actual string that is passed is much longer, but it appears that the "//" is what is causing the issues. When it is removed the command is passes with no problem. The actual iRule is also much longer, however, the variable is set up at the top and I'm not sure if something else in the iRule could be messing that up. Is "//" some sort of escape sequence and if so, can it be ignored?

     

     

    Chris

     

    // can be used to comment out text so it isn't processed....that's why I was curious about what happened if you put quotes around the area to which you were setting your variable value.

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jun 15, 2010
    I don't think // has any special meaning in TCL or iRules though.

     

     

    Chris, can you post an anonymized example of a URL that breaks with URI::query? I tested on 10.0.1HF0 and didn't see a problem with the example iRule I posted above.

     

     

    Aaron
  • Chadri_103513's avatar
    Chadri_103513
    Icon for Nimbostratus rankNimbostratus
    Jun 15, 2010
    Chris,

     

     

    I tried placing quotes around the set cmd string as you suggested (set cmd "[ URI::query [string tolower [HTTP::uri]] command ]") but that didn't seem to help. I still get an empty variable when "//" is present.
  • Chadri_103513's avatar
    Chadri_103513
    Icon for Nimbostratus rankNimbostratus
    Jun 15, 2010
    Is there a way to simply search the URI for "//" and replace those characters with "" or something else?

     

     

    Chris
  • L4L7_53191's avatar
    L4L7_53191
    Icon for Nimbostratus rankNimbostratus
    Jun 16, 2010
    Regarding your last question about the replacement of "//", as an example here's how I'd go after manipulating the query to remove the "//" from "http://". 

     when HTTP_REQUEST { 
  
 set orig_query [HTTP::query] 
 set new_query [string map {"http://" "http:"} $orig_query] 
 log local0. "New query is $new_query" 
  
 }
    Note: I've overly used variables for the sake of the example. You could very well simplify (and save cycles) to a single line like:

    set new_query [string map {"http://" "http:"} [HTTP::query]]

    HTH,

    -Matt
  • Chadri_103513's avatar
    Chadri_103513
    Icon for Nimbostratus rankNimbostratus
    Jun 16, 2010
    Matt,

     

     

    Using a string map is the way that I ended up going and it seems to be working. I hate to add extra lines to an already oversized iRule, but it seems to do the trick. I simply had to modify my set cmd lines to first strip the URI of "//".

     

     

    if { [HTTP::query] contains "//" } {

     

    set cmd2 [string map -nocase {"//" ""} [HTTP::uri]]

     

    set cmd [ URI::query [string tolower $cmd2] command ]

     

     

    Thanks for your help,

     

     

    Chris
  • L4L7_53191's avatar
    L4L7_53191
    Icon for Nimbostratus rankNimbostratus
    Jun 18, 2010
    Great news, glad you're working. Once you're all stable and running well, let's revisit the rule to make those class calls CMP friendly (if that'll be of value to you - not sure what class of hardware you're on).

     

     

    -Matt