For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ShakN_167332's avatar
ShakN_167332
Icon for Nimbostratus rankNimbostratus
Sep 10, 2014

URI redirection issue with upper/lower case traffic

hi when user types lower case redirection works but when users types uppers it is not working..

eg: user come /bseu/finance it should redirect to /sites/finance this is working..now if user comes with /bseu/FINANCE it is not redirecting to sites.

Data group is test where i have created string /bseu/finance value /sites/finance

if { [class match [string tolower [HTTP::path]] starts_with test] } {
    set origin [class match -name [string tolower [HTTP::path]] starts_with test]
    set new [class match -value [string tolower [HTTP::path]] starts_with test]
    HTTP::uri [string map "$origin $new" [HTTP::uri]]
        log local0. "New URI = $new" }

10 Replies

  • Try this subtle change:

    if { [class match [string tolower [HTTP::path]] starts_with test] } {
        set origin [class match -name [string tolower [HTTP::path]] starts_with test]
        set new [class match -value [string tolower [HTTP::path]] starts_with test]
        HTTP::uri [string map "$origin $new" [string tolower [HTTP::uri]]]
        log local0. "New URI = $new" 
    }
    
  • hi can you please help me in this requirement.

     

    in data group i have created string for /bseu/finance and value as /sites/finance but when user type full url like /bseu/finance/sitepage/home.apsx than it is not reduirecting.. how to modify my data group..

     

  • The class match should be working. Do you see the log entry in the LTM log?

    log local0. "New URI = $new" 
    

    When you say "redirecting", understand that you're not going to see this change on the client side. The HTTP::uri is going to transparently change the URI on its way through to the server. Can you watch the traffic on the server side to see if the URI does (or doesn't) change?

  • Right, so two things:

     

    1. Do you see the log message? This should only be triggered if you're matching the data group entry.

       

    2. The iRule is replacing /bseu/finance with /sites/finance, so does /bseu/sites/xyz/abc exists? If you actually watch the traffic with a tcpdump on the server (assuming it's not encrypted), you should be able to see the URI in the request.

       

  • The logging is a little off, but that basically indicates that the URI rewrite is happening. So in a tcpdump:

    tcpdump -lnni 0.0 -Xs0 host [IP of web server]
    

    You should be able to see the translated URI in the client's request.

  • Hi kevin,

     

    I tried to open the below url

     

    asites.abc.com/bseu/finance/sitepage/home.aspx and as per irule it should redirect to asites.abc.com/sites/finance/sitepage/home.aspx but it is not happening in address bar it is still showing asites.abc.com/bseu/finance/sitepage/home.aspx where as in site content i am able to see the redirected site contents.

     

    as these are sharepoint sites so users are saying they can not give any specfic incoming url they can try asites.abc.com/bseu/finance/ or asites.abc.com/bseu/finance/sitepage/ or asites.abc.com/bseu/finance/sitepage/home.aspx full url.. in allm these case it should redirect to asites.abc.com/sites/finance/sitepage/home.aspx

     

    Can we check like a regex expresion in data group like sting /besu/finance/* should redirect to /sites/finance/* "where * is any thing after that..."

     

  • but it is not happening in address bar

    I think this might be the problem. You're using the HTTP::uri command but expecting to see something in the browser address bar. That is not what this command does. This command alters the URI as it passes through the box. It does not issue an HTTP redirect, nor does it change the browser's address bar. Try using the HTTP::redirect command instead:

    set newuri [string map "$origin $new" [string tolower [HTTP::uri]]]
    HTTP::redirect "https://[HTTP::host]${newuri}"
    
  • You haven't shown the complete iRule, but I'm assuming here you're doing other things besides changing the URI. If you're attempting to change an ingress HTTP header AND send an HTTP redirect, these are conflicting flows. You need an if/elseif condition to make sure you're no trying to do both.

     

  • Try this:

    when RULE_INIT { 
        set static::asitesext "asites.abc.com" 
        set static::asitesint "asites.internet.abc.com" 
        set static::aportalext "aportal.abc.com" 
        set static::aportalint "aportal.internet.abc.com" 
        set static::amyext "amy.abc.com" 
        set static::amyint "amy.internet.abc.com" 
        set static::aextranetext "aextranet.abc.com" 
        set static::aextranetint "aextranet.internet.abc.com" 
        set static::awww "awww.abc.com" 
    } 
    when HTTP_REQUEST { 
        if { [class match [IP::client_addr] equals InternalHosts] } {
            log local0. "Redirecting based on InternalHosts match"
            HTTP::redirect http://[HTTP::host][HTTP::uri] 
        } elseif { [class match [string tolower [HTTP::path]] starts_with test] } {
            log local0. "Redirecting based on test match: [HTTP::uri]"
            set origin [class match -name [string tolower [HTTP::path]] starts_with test] 
            set new [class match -value [string tolower [HTTP::path]] starts_with test] 
            set newuri [string map "$origin $new" [string tolower [HTTP::uri]]] 
            HTTP::redirect "https://[HTTP::host]${newuri}" 
            log local0. "New URI = $newuri" 
        } else { 
            log local0. "Replacing the HTTP Host header: [HTTP::host]"
            switch -glob -- [string tolower [HTTP::host]] { 
                "asites.abc.com" { 
                    HTTP::header replace Host $static::asitesint 
                    STREAM::disable 
                } 
                "awww.abc.com" { 
                    HTTP::redirect "https://aportal.abc.com" 
                    STREAM::disable 
                } 
                "aportal.abc.com" { 
                    HTTP::header replace Host $static::aportalint 
                    STREAM::disable 
                } 
                "amy.abc.com" { 
                    HTTP::header replace Host $static::amyint 
                    STREAM::disable 
                } 
                "aextranet.abc.com" { 
                    HTTP::header replace Host $static::aextranetint 
                    STREAM::disable 
                } 
            } 
        } 
    } 
    when HTTP_RESPONSE { 
        if { [HTTP::is_redirect] && [string tolower [HTTP::header "Location"]] contains $static::asitesint } { 
            HTTP::header replace Location [string map "$static::asitesint $static::asitesext" [HTTP::header Location]] 
            STREAM::enable 
        } elseif { [HTTP::is_redirect] && [string tolower [HTTP::header "Location"]] contains $static::aportalint } { 
            HTTP::header replace Location [string map "$static::aportalint $static::aportalext" [HTTP::header Location]] 
            STREAM::enable 
        } elseif { [HTTP::is_redirect] && [string tolower [HTTP::header "Location"]] contains $static::amyint } { 
            HTTP::header replace Location [string map "$static::amyint $static::amyext" [HTTP::header Location]] 
            STREAM::enable 
        } elseif { [HTTP::is_redirect] && [string tolower [HTTP::header "Location"]] contains $static::aextranetint } { 
            HTTP::header replace Location [string map "$static::aextranetint $static::aextranetext" [HTTP::header Location]] 
            STREAM::enable 
        } 
    }
    

    Just out of curiosity, do you have a custom STREAM profile defined?