For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ghost-rider_124's avatar
ghost-rider_124
Icon for Nimbostratus rankNimbostratus
Jul 16, 2014

Stream profile vs redirect rewrite in http profile vs proxy pass irule

Hello Experts

 

To mask the URL or references in the code, we can use stream profile under LTM, stream irule, redirect rewrite and proxy irule. What is the difference between all those methods? In which scenario each one is appropriate. Please give me example as well.

 

Regards,

 

GR

 

4 Replies

  • The stream profile performs find/replace on the byte stream (request or response) without having to buffer any data. An irule must buffer to perform a replacement. Stream profiles lack the ability to define that conditions/criteria be met before performing replacement which is why you see examples of an irule calling a stream profile. This allows the irule to examine conditions and decide if a replacement should be done by the stream profile.

     

    See this SOL8115 for stream profile info.

     

    The redirect rewrite setting in the http profile does not rewrite content. It acts on redirects only. It is used to change an http redirect from the pool member to https before passing it to the client - useful when offloading ssl on the BIG-IP. This setting also has a node option for cases where the app on the pool member redirects the client to the node IP. When using 'node' BIG-IP changes the node addr to the virtual address before passing the response to client.

     

  • Ghost-rider, I assume you're referring to this ProxyPass iRule found on DevCentral.

     

    This rule will do what you describe and rewrite the hostname/path in a request to whatever is used on the server-side. By default the rule only rewrites headers, it has optional areas of code that utilize the stream profile feature to rewrite links embedded in the body of requests/responses.

     

    Hiding server port numbers is simple. The pool members on LTM can be configured for any port you like. A virtual server will, by default, translate its IP:port to the pool members IP:port.

     

    Scott

     

  • Hi Scott

     

    Yes I am referring to same irule. Sorry for my ignorance.

     

    1- But what is the difference between header rewrite and references in body? 2- For my requirement, as described in above post, should I need to rewrite headers or both header and references in body? 3- Also I need to rewrite the port in server response as well?

     

    Appreciated

     

  • Questions 1 & 2 answer: HTTP request line and headers contain the hostname/path/file.html information that you may wish to rewrite to match the path/filename used on the server side. In addition the actual page that the server responds with may contain links to other parts of the application that need to be rewritten to the client-side naming convention. This is header and content (body) rewriting.

     

    Question 3 answer: the client never sees the server port number only the virtual servers port. I am not aware of any standard HTTP response header which would contain the server port though it's possible your app might be doing this. You should consult with the app administrators and developers to determine this.