For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

CraigM_17826's avatar
CraigM_17826
Icon for Altocumulus rankAltocumulus
Dec 02, 2009

Very odd behaviour when URI contains a - or _ in a string you are checking for

Hi everyone,

 

 

I think I have come across an odd issue with using string compares for selecting pools. I am checking for a specfic piece of text in a URL and if it is found it will use a certain pool. If the pool members are down then it will use an alternate pool. Here is the code extract fro within the HTTP_REQUEST context

 

 

 

if { [string tolower [HTTP::uri]] contains "/exam-services" } {

 

if { [active_members "ExamServices"] > 0 } {

 

pool "ExamServices"

 

return 0

 

} else {

 

HTTP::redirect "http://server1.acme.com/exam-services"

 

pool "ExamServices_Error"

 

return 0

 

}

 

}

 

 

 

This is what happens

 

 

www.acme.com/exam-services (fails)

 

www.acme.com/exam-serices/ (works)

 

 

When it fails, I get the following error from WebSphere

 

 

SRVE0255E: A WebGroup/Virtual Host to handle /exam%2Dservices/ has not been defined.

 

SRVE0255E: A WebGroup/Virtual Host to handle www.acme.com:10040 has not been defined.

 

 

What is odd is that WebSphere is showing the URI as exam%2Dserices. Why it is doing this is odd, and why adding a trailing / to the URI causes it to work.

 

 

Now I do have a lot of other URI compararions and they all work but I jsut realised this particular URI comparison the ONLY one which has a -in the URI. So I changed the test to check for examservices and made th required change and it now works

 

 

www.acme.com/examservices

 

www.acme.com/examservices/

 

 

So I am now wondering why the - character is causing the string comparison is causing the pool based connection to act this way. Out of interest I put the search string back to exam-services and changed the piece of code to use a http::redirect instead of pool and it worked fine, though a redirect is not what I require.

 

 

I have since done some tests using _ and . in the string with the following results

 

 

www.acme.com/exam_services

 

(fails with SRVE0255E: A WebGroup/Virtual Host to handle /exam%5Fservices/ has not been defined)

 

www.acme.com/exam_services/ (works)

 

www.acme.com/exam.services (works)

 

 

So whatever this issue is it is only manifesting itself when I use either a - or _ in the URI.

 

 

Does anyone have any idea why this is occuring? Unfortunatley I have no control over the URI the company want's to use and our marketing people are adament it has to be /exam-services

 

 

I have also tried using starts_within the test with no changes, all of the above tests behave in the same way with the same results as when using contains

 

 

Regards

 

 

Craig

 

application delivery
dev
devops
iRules

4 Replies

  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Dec 02, 2009
    Hi Craig,

    I don't believe you need to use quotes when defining you pool

    I.E. 

     
 when HTTP_REQUEST { 
 if { [string tolower [HTTP::uri]] contains "/exam-services" } { 
 if { [active_members ExamServices] > 0 } { 
 pool ExamServices 
 } else { 
 pool ExamServices_Error 
 } 
 } 
 }

    Assuming that ExamServices and ExamServices_Error is your pool names

    Also I don't think need to add a return 0 to execute out of the event since it's going to do that with your IF-ELSE statement intrinsically

    Bhattman
  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Dec 02, 2009
    Hi Brian,

    After your reading your article a second time the iRule is basically inspecting the URI and then passing that information to a selected pool member. It's not changing the URI so I suspect that it might be something with websphere rather then load balancer or the Irule

    However you could add logging statements so you can check

    I.E 

     
 when HTTP_REQUEST {  
       log local0. "This is the uri: [HTTP::uri] that the irule receives" 
  if { [string tolower [HTTP::uri]] contains "/exam-services" } {  
  if { [active_members ExamServices] > 0 } {  
  pool ExamServices  
  } else {  
  pool ExamServices_Error  
  }  
  }  
  }

    I hope this helps

    Bhattman

  • CraigM_17826's avatar
    CraigM_17826
    Icon for Altocumulus rankAltocumulus
    Dec 02, 2009
    Hi everyone,

     

     

    I have partially found out what is going on and I think I have a fix. I'll post an update when I know for sure. In the meantime don't waste any of your time on this as I'm fairly confident we will have it fixed and you all probably have better things to do.

     

     

    Regards

     

     

    Craig
  • CraigM_17826's avatar
    CraigM_17826
    Icon for Altocumulus rankAltocumulus
    Dec 02, 2009
    Hi all,

     

     

    problem solved. Was not a BigIP issue at all. The special char substitution was being done by an IIS server that was in one of the pools. The URL it was being directed to was referencing a directory but it didn't contain a trailing / in the URI so IIS was expecting it to be an application or content. Changing the rule to check for this and add a trailing / when required has fixed this. IIS was also translating the - to %2D in it's 301 response back to the bigip which in turn was sent to WebSphere, hence the WebSphere error that contained the %2D translation of the - in the original URI.

     

     

    All fixed.

     

     

    Craig