For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Steph's avatar
Steph
Icon for Nimbostratus rankNimbostratus
Mar 02, 2017

Unexplained TCL Error on iRule

I have taken over a system with an iRule producing following error. The thing is running on a sensible production environment and seems to do what it should... but the error is polluting my logs.

Error: 

Mar 2 13:13:55 slot1/waf err tmm1[21022]: 01220001:3: TCL error: /Common/RewriteUrl - Operation not supported (line 10) invoked from within "HTTP::header replace "Host" intranetprivate.site.cl.eu" ("10.10.." arm line 4) invoked from within "switch -glob [IP::client_addr] { "10.10.24.15" { log local0. "CLIENT: [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]" ..."

iRule:

when HTTP_REQUEST {
    set DEBUG 0
    if { $DEBUG } {
        set LogString "-Before- Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]" 
        log local0. "============================================="
        log local0. "$LogString (request)"
        foreach aHeader [HTTP::header names] {  
            log local0. "$aHeader: [HTTP::header value $aHeader]" 
        }
        log local0. "=============================================" 
    }
    switch -glob [IP::client_addr] {
        "10.10.24.15" {
            log local0. "CLIENT: [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]" 
            HTTP::header replace "Host" intranetprivate.site.cl.eu
            HTTP::header replace "host" intranetprivate.site.cl.eu
        }
        "10.10.24.249" {
            log local0. "CLIENT:  [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]" 
            HTTP::header replace "Host" intranetprivate.site.cl.eu
            HTTP::header replace "host" intranetprivate.site.cl.eu
        }
        "10.10.*.*" {
            log local0. "CLIENT: [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]" 
            HTTP::header replace "Host" intranetprivate.site.cl.eu
            HTTP::header replace "host" intranetprivate.site.cl.eu
        }
        default {
            HTTP::header replace "host" intranetprivate.site.cl.eu
        }
    }
    if { $DEBUG } {
        set LogString "-After- Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]" 
        log local0. "============================================="
        log local0. "$LogString (request)"
        foreach aHeader [HTTP::header names] {  
            log local0. "$aHeader: [HTTP::header value $aHeader]" 
        }
        log local0. "=============================================" 
    }
}
when HTTP_RESPONSE {
    if { $DEBUG } {
        set LogString "-Before- Client [IP::client_addr]:[TCP::client_port]" 
        log local0. "============================================="
        log local0. "$LogString (response)"
        log local0. "status [HTTP::status]"
        foreach aHeader [HTTP::header names] {
            log local0. "$aHeader: [HTTP::header value $aHeader]"
        }
        log local0. "=============================================" 
    }
    switch -glob [IP::client_addr] {
        "10.10.24.15" {
        }
        "10.10.24.249" {
        }
        default {
            switch -glob [HTTP::status] {
                "30*" {
                    HTTP::header replace "Host" intranet.site.cl.eu
                    HTTP::header replace Location [string map -nocase {intranetprivate.site.cl.eu intranet.site.cl.eu} [HTTP::header value Location]] 
                }
            }
        }
    }
    if { $DEBUG } {
        set LogString "-After- Client [IP::client_addr]:[TCP::client_port]" 
        log local0. "============================================="
        log local0. "$LogString (response)"
        log local0. "status [HTTP::status]"
        foreach aHeader [HTTP::header names] {
            log local0. "$aHeader: [HTTP::header value $aHeader]"
        }
        log local0. "=============================================" 
    }
}

Cheers St.

1 Reply

  • Hi,

    is there another irule assigned to the same VS and running before this irule?

    This message often appears when an irule (or a policy) executed before a command like HTTP::redirect. from this point, next code is executed but HTTP::header insert, HTTP::redirect, HTTP::respond commands are not allowed!