For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Leslie_South_55's avatar
Leslie_South_55
Icon for Nimbostratus rankNimbostratus
Oct 17, 2008

Using LB_FAILED and change the URI w/o 302

I am trying to use the 'when LB_FAILED' to send requests a pool just for apologies. The issue is that the requests coming into the VS have crazy long URI strings like '/ABC/def/g/hij/klmno/' and my sorry server is running a simple HTML page at '/apologies/apologies.htm' I have configured this directory and page to be the default, so I can hit the server directly at 'http://host.domain.com/' and get the correct content. I have tried a few different variations, and can't seem to be able to change the URI after 'when LB_FAILED' before the request goes to the apologies pool.

Rev 1, I added some logging to see what was being passed 

 
 when LB_FAILED { 
 log local0. "URI is [HTTP::uri]" 
 log local0. "$poolname has [active_members [LB::server pool]] members" 
 log local0. "URI is [HTTP::uri]" 
 pool pool_apologies_http 
 log local0. "Directed to pool [LB::server pool]" 
   }

Rev 2, tied the HTTP::uri command 

 
 when LB_FAILED { 
 log local0. "URI is [HTTP::uri]" 
 log local0. "$poolname has [active_members [LB::server pool]] members" 
  HTTP::uri "/" 
 log local0. "URI is [HTTP::uri]" 
 pool pool_apologies_http 
 log local0. "Directed to pool [LB::server pool]" 
   }

Can I do this with the 'when LB_FAILED' command, or does it have to be HTTP_REQUEST??

Thanks,

-L
application delivery
dev
devops
iRules

14 Replies

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Oct 17, 2008
    Hi lsouth,

     

     

    You can force a reselect from a new pool using LB::reselect pool $my_pool, but it gets more complicated if you want to serve multiple files (like html and images) from that pool:

     

     

    Maintenance Page iRule (Click here)

     

     

    If you do need to support multiple objects for the maintenance page, you could not rewrite the URI if the Referer header ends with the maintenance page.

     

     

    I haven't test any of this, but at least the HTTP::uri update was working for DJ-Boston.

     

     

    Aaron
  • Leslie_South_55's avatar
    Leslie_South_55
    Icon for Nimbostratus rankNimbostratus
    Oct 20, 2008
    Changing to LB::reselect works, but I am having the same issue as DJ-Boston, no images....
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Oct 20, 2008
    Can you try this then? I assume HTTP::referer should work in LB_FAILED if HTTP::uri does, but haven't tested this before. 

     
 when LB_FAILED { 
  
    log local0. "[IP::client_addr]:[TCP::client_port]: Request to pool failed, [LB::server pool]" 
  
     Check if this request was not generated from the maintenance page using the HTTP referer header 
    if {not ([HTTP::header value referer] ends_with "/maintenance_page.html")}{ 
  
       log local0. "[IP::client_addr]:[TCP::client_port]: Referer wasn't the maintenance page.  Rewriting URI to maintenance page." 
       HTTP::uri "/maintenance_page.html" 
    } 
  
     Send request to the apologies pool 
    LB::reselect pool pool_apologies_http 
    log local0. "[IP::client_addr]:[TCP::client_port]: Reselecting member from the apologies pool" 
 }

    Aaron
  • Leslie_South_55's avatar
    Leslie_South_55
    Icon for Nimbostratus rankNimbostratus
    Oct 20, 2008
    Here is the rule with mods for my environment 

     
  when LB_FAILED { 
        log local0. "[IP::client_addr]:[TCP::client_port]: Request to pool failed, [LB::server pool]" 
     Check if this request was not generated from the maintenance page using the HTTP referer header 
   if {not ([HTTP::header value referer] ends_with "/apologies.htm")}{ 
    log local0. "[IP::client_addr]:[TCP::client_port]: Referer wasn't the maintenance page.  Rewriting URI to maintenance page." 
    HTTP::uri "/" 
   } 
    Send request to the apologies pool 
    LB::reselect pool pool_apologies_http 
    log local0  "[IP::client_addr]:[TCP::client_port]: Reselecting member from the apologies pool" 
 }

    and here are my logs

    Rule rule_apologies_http-referrer : 10.20.45.9:2756: Request to pool failed, pool_prod

    Rule rule_apologies_http-referrer : 10.20.45.9:2756: Referer wasn't the maintenance page.

    01220001:3: TCL error: Rule rule_apologies_http-referrer - wrong args: should be "log"

    Rule rule_apologies_http-referrer : 10.20.45.9:2756: Request to pool failed, pool_prod

    Rule rule_apologies_http-referrer : 10.20.45.9:2756: Referer wasn't the maintenance page.

    01220001:3: TCL error: Rule rule_apologies_http-referrer - wrong args: should be "log"

    Rule rule_apologies_http-referrer : 10.20.45.9:2757: Request to pool failed, pool_prod

    Rule rule_apologies_http-referrer : 10.20.45.9:2757: Referer wasn't the maintenance page.

    01220001:3: TCL error: Rule rule_apologies_http-referrer - wrong args: should be "log"

    Rule rule_apologies_http-referrer : 10.20.45.9:2756: Request to pool failed, pool_prod

    Rule rule_apologies_http-referrer : 10.20.45.9:2756: Referer wasn't the maintenance page.

    01220001:3: TCL error: Rule rule_apologies_http-referrer - wrong args: should be "log"

    Rule rule_apologies_http-referrer : 10.20.45.9:2757: Request to pool failed, pool_prod

    Rule rule_apologies_http-referrer : 10.20.45.9:2757: Referer wasn't the maintenance page.

    01220001:3: TCL error: Rule rule_apologies_http-referrer - wrong args: should be "log"

    Rule rule_apologies_http-referrer : 10.20.45.9:2756: Request to pool failed, pool_prod

    Rule rule_apologies_http-referrer : 10.20.45.9:2756: Referer wasn't the maintenance page.

    Rule rule_apologies_http-referrer : 10.20.45.9:2757: Request to pool failed, pool_prod

    Rule rule_apologies_http-referrer : 10.20.45.9:2757: Referer wasn't the maintenance page.

    Rule rule_apologies_http-referrer : 10.20.45.9:2756: Request to pool failed, pool_prod

    Rule rule_apologies_http-referrer : 10.20.45.9:2756: Referer wasn't the maintenance page.

    Rule rule_apologies_http-referrer : 10.20.45.9:2757: Request to pool failed, pool_prod

    Rule rule_apologies_http-referrer : 10.20.45.9:2757: Referer wasn't the maintenance page.

    Rule rule_apologies_http-referrer : 10.20.45.9:2756: Request to pool failed, pool_prod

    Rule rule_apologies_http-referrer : 10.20.45.9:2756: Referer wasn't the maintenance page.

    Rule rule_apologies_http-referrer : 10.20.45.9:2757: Request to pool failed, pool_prod

    Rule rule_apologies_http-referrer : 10.20.45.9:2757: Referer wasn't the maintenance page.

    Rule rule_apologies_http-referrer : 10.20.45.9:2757: Request to pool failed, pool_prod

    Rule rule_apologies_http-referrer : 10.20.45.9:2757: Referer wasn't the maintenance page.

    Rule rule_apologies_http-referrer : 10.20.45.9:2758: Request to pool failed, pool_prod

    Rule rule_apologies_http-referrer : 10.20.45.9:2758: Referer wasn't the maintenance page.

    01220001: repeated 8 times

  • Leslie_South_55's avatar
    Leslie_South_55
    Icon for Nimbostratus rankNimbostratus
    Oct 20, 2008
    I also checked the HTTP headers and I am not seeing a referrer, but I am seeing

     

     

    Content-Location: http://host.domain.com/apologeis.htm

     

     

    -L
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Oct 21, 2008
    In order to work, the URI you check for in the Referer header and what you set the URI should be the same value in both places in the rule. And it should be different from normal pages that a user would request (so not something like "/" or "index.htm"). Can you test by renaming the maintenance page on the sorry pool server to something like /maintenanace.htm and use the rule below with more logging?

    Also, there was an error in your example from a missing period in the syslog facility (log local "...") which generated the TCL error in the logs. 

     
  when LB_FAILED {  
    
     log local0. "[IP::client_addr]:[TCP::client_port]: Request for [HTTP::uri] from [HTTP::header Referer] to pool failed, [LB::server pool]"  
    
      Check if this request was not generated from the maintenance page using the HTTP referer header  
     if {not ([HTTP::header value referer] ends_with "/maintenance.htm")}{  
    
        log local0. "[IP::client_addr]:[TCP::client_port]: Referer wasn't the maintenance page.  Rewriting URI to maintenance page."  
        HTTP::uri "/maintenance.htm"  
     } 
    
      Send request to the apologies pool  
     LB::reselect pool pool_apologies_http  
     log local0. "[IP::client_addr]:[TCP::client_port]: Reselecting member from the apologies pool"  
  }

    Aaron
  • Leslie_South_55's avatar
    Leslie_South_55
    Icon for Nimbostratus rankNimbostratus
    Oct 21, 2008
    Sorry about the type-o in the log statement..I have renamed the site to maintenance.htm and it has an associated maintenance_files folder for all the "stuff" (images, css, js) I see now that the request is for my full app path "/Library/controller/e/web/Portal/en/maintenance_files/c.gif" for all the images, etc. ideally we would want "/maintenance_files/c.gif"..any way around this that you can think of? The maintenance page is provided by our customer, so we can't really change the content, hence all the JS and CSS files.

     

     

     

    : 10.20.45.9:4741: Request for /Library/controller/e/web/Portal/en/Customer:Enter from to pool failed, pool_prod

     

    : 10.20.45.9:4741: Referer wasn't the maintenance page. Rewriting URI to maintenance page.

     

    : 10.20.45.9:4741: Reselecting member from the apologies pool

     

    : 10.20.45.9:4741: Request for /Library/controller/e/web/Portal/en/maintenance_files/main.css from http://host.domain.com/Library/controller/e/web/Portal/en/Customer:Enter to pool failed, pool_prod

     

    : 10.20.45.9:4741: Referer wasn't the maintenance page. Rewriting URI to maintenance page.

     

    : 10.20.45.9:4741: Reselecting member from the apologies pool

     

    : 10.20.45.9:4742: Request for /Library/controller/e/web/Portal/en/maintenance_files/screen.css from http://host.domain.com/Library/controller/e/web/Portal/en/Customer:Enter to pool failed, pool_prod

     

    : 10.20.45.9:4742: Referer wasn't the maintenance page. Rewriting URI to maintenance page.

     

    : 10.20.45.9:4742: Reselecting member from the apologies pool

     

    : 10.20.45.9:4741: Request for /Library/controller/e/web/Portal/en/maintenance_files/table.css from http://host.domain.com/Library/controller/e/web/Portal/en/Customer:Enter to pool failed, pool_prod

     

    : 10.20.45.9:4741: Referer wasn't the maintenance page. Rewriting URI to maintenance page.

     

    : 10.20.45.9:4741: Reselecting member from the apologies pool

     

    : 10.20.45.9:4742: Request for /Library/controller/e/web/Portal/en/maintenance_files/print.css from http://host.domain.com/Library/controller/e/web/Portal/en/Customer:Enter to pool failed, pool_prod

     

    : 10.20.45.9:4742: Referer wasn't the maintenance page. Rewriting URI to maintenance page.

     

    : 10.20.45.9:4742: Reselecting member from the apologies pool

     

    : 10.20.45.9:4741: Request for /Library/controller/e/web/Portal/en/maintenance_files/detection.js from http://host.domain.com/Library/controller/e/web/Portal/en/Customer:Enter to pool failed, pool_prod

     

    : 10.20.45.9:4741: Referer wasn't the maintenance page. Rewriting URI to maintenance page.

     

    : 10.20.45.9:4741: Reselecting member from the apologies pool

     

    : 10.20.45.9:4742: Request for /Library/controller/e/web/Portal/en/maintenance_files/dropdown.js from http://host.domain.com/Library/controller/e/web/Portal/en/Customer:Enter to pool failed, pool_prod

     

    : 10.20.45.9:4742: Referer wasn't the maintenance page. Rewriting URI to maintenance page.

     

    : 10.20.45.9:4742: Reselecting member from the apologies pool

     

    : 10.20.45.9:4741: Request for /Library/controller/e/web/Portal/en/maintenance_files/c.gif from http://host.domain.com/Library/controller/e/web/Portal/en/Customer:Enter to pool failed, pool_prod

     

    : 10.20.45.9:4741: Referer wasn't the maintenance page. Rewriting URI to maintenance page.

     

    : 10.20.45.9:4741: Reselecting member from the apologies pool

     

    : 10.20.45.9:4742: Request for /Library/controller/e/web/Portal/en/maintenance_files/mast-logo.gif from http://host.domain.com/Library/controller/e/web/Portal/en/Customer:Enter to pool failed, pool_prod

     

    : 10.20.45.9:4742: Referer wasn't the maintenance page. Rewriting URI to maintenance page.

     

    : 10.20.45.9:4742: Reselecting member from the apologies pool

     

    : 10.20.45.9:4741: Request for /Library/controller/e/web/Portal/en/maintenance_files/image001.gif from http://host.domain.com/Library/controller/e/web/Portal/en/Customer:Enter to pool failed, pool_prod

     

    : 10.20.45.9:4741: Referer wasn't the maintenance page. Rewriting URI to maintenance page.

     

    : 10.20.45.9:4741: Reselecting member from the apologies pool

     

    : 10.20.45.9:4742: Request for /Library/controller/e/web/Portal/en/maintenance_files/pmh.js from http://host.domain.com/Library/controller/e/web/Portal/en/Customer:Enter to pool failed, pool_prod

     

    : 10.20.45.9:4742: Referer wasn't the maintenance page. Rewriting URI to maintenance page.

     

    : 10.20.45.9:4742: Reselecting member from the apologies pool

     

    : 10.20.45.9:4741: Request for /Library/controller/e/web/Portal/en/maintenance_files/left-nav-corner.gif from http://host.domain.com/Library/controller/e/web/Portal/en/Customer:Enter to pool failed, pool_prod

     

    : 10.20.45.9:4741: Referer wasn't the maintenance page. Rewriting URI to maintenance page.

     

    : 10.20.45.9:4741: Reselecting member from the apologies pool

     

    : 10.20.45.9:4742: Request for /Library/controller/e/web/Portal/en/maintenance_files/443.jpg from http://host.domain.com/Library/controller/e/web/Portal/en/Customer:Enter to pool failed, pool_prod

     

    : 10.20.45.9:4742: Referer wasn't the maintenance page. Rewriting URI to maintenance page.

     

    : 10.20.45.9:4742: Reselecting member from the apologies pool

     

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Oct 21, 2008
    Of course... the client never knows about the maintenance URI as it's not being sent a redirect. So the Referer header value still shows the original URI it was making the request from. How about checking for the string "/maintenance_files/" in the requested URI and not rewriting those requests? Is it safe to assume that only the maintenance files will have that in the URI? 

     
   when LB_FAILED {   
      
      log local0. "[IP::client_addr]:[TCP::client_port]: Request for [HTTP::uri] from Referer '[HTTP::header Referer]' to pool failed, [LB::server pool]"   
      
       Check if this request was not generated from the maintenance page using the HTTP referer header   
      if {not ([HTTP::path] contains "/maintenance_files/")}{   
      
         log local0. "[IP::client_addr]:[TCP::client_port]: Referer wasn't the maintenance page.  Rewriting URI to maintenance page."   
         HTTP::uri "/maintenance.htm"   
      }  
      
       Send request to the apologies pool   
      LB::reselect pool pool_apologies_http   
      log local0. "[IP::client_addr]:[TCP::client_port]: Reselecting member from the apologies pool"   
   }

    Aaron
  • Leslie_South_55's avatar
    Leslie_South_55
    Icon for Nimbostratus rankNimbostratus
    Oct 22, 2008
    Now I am getting 404's for all the images

     

     

     

    GET /Library/controller/e/web/Portal/en/maintenance_files/maintenance_files/main.css HTTP/1.1

     

    Accept: */*

     

    Referer: http://host.domain.com/Library/controller/e/web/Portal/en/Customer:Enter

     

    Accept-Language: en-us

     

    Accept-Encoding: gzip, deflate

     

    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1; .NET CLR 2.0.50727; MS-RTC LM 8)

     

    Host: host.domain.com

     

    Connection: Keep-Alive

     

    Cookie: f5_cookie=369694218.20480.0000

     

     

    HTTP/1.1 404 Not Found

     

    Content-Length: 1635

     

    Content-Type: text/html

     

    Server: Microsoft-IIS/6.0

     

    X-Powered-By: ASP.NET

     

    Date: Wed, 22 Oct 2008 15:10:37 GMT

     

    Connection: keep-alive

     

    Set-Cookie: f5_cookie=369694218.20480.0000; path=/

     

     

     

     

    Here is the log from the webserver, 10.22.9.22 is the server IP and 10.22.9.10 is the LTM's SNAT IP

     

     

     

    2008-10-22 15:10:37 W3SVC1799446788 10.22.9.22 GET /Library/controller/e/web/Portal/en/maintenance_files/maintenance_files/main.css - 80 - 10.22.9.10 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+InfoPath.1;+.NET+CLR+2.0.50727;+MS-RTC+LM+8) 404 0 64

     

     

     

     

    This repeats for every request to the 'maintenance_files' objects.

     

     

    -L