For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Nathan_at_Hamli's avatar
Nathan_at_Hamli
Icon for Nimbostratus rankNimbostratus
Oct 06, 2014

Writing First iRule, redirects and rewrites based on URI

Looking for some assistance as a total iRule novice:

The expected behavior is that if an HTTP request against the virtual server is for the root it will redirect to /pwclient/ on the default pool, if the request starts with /copy* it will rewrite the uri as /helixws*

when HTTP_REQUEST {  
     if { ([HTTP::uri] == "/") } {
        HTTP::redirect "/pwclient/"
     } elseif { ([HTTP::uri] starts_with "/copy") } {
        pool piperxpress_copy_tcp_443_pool
        set uri [string map -nocase {"/copy" "/helixws"} [HTTP::uri]]
        HTTP::uri $uri
     }
}

The first half of this conditional works, however the second (rewrite URI and pull from non-default pool) does not... based on the access logs in the second pool it doesn't even appear to be hitting the pool.

If anyone could point me in the right direction, I would appreciate it.

application delivery
devops
iRules
LTM

5 Replies

  • Nathan_at_Hamli's avatar
    Nathan_at_Hamli
    Icon for Nimbostratus rankNimbostratus
    Oct 06, 2014
    When I look at "Statistics ›› Module Statistics : Local Traffic ›› Pools" for the second pool I do see the total connection counts go up when attempting to access the virtual server, if no one has any better ideas my next step will probably be to sniff the traffic to see what the actual GET request is.
  • Patrik_Jonsson's avatar
    Patrik_Jonsson
    Icon for MVP rankMVP
    Oct 06, 2014

    Don't have access to an LTM now, but try this?

    when HTTP_REQUEST {

    set uri [string tolower [HTTP::uri]]

     if { $uri == "/") } {
        HTTP::redirect "/pwclient/"
     } elseif { $uri starts_with "/copy" } {

        set uri [string map -nocase {"/copy" "/helixws"} $uri]
        HTTP::uri $uri
        pool piperxpress_copy_tcp_443_pool
     }
}

    /Patrik

  • Nathan_at_Hamli's avatar
    Nathan_at_Hamli
    Icon for Nimbostratus rankNimbostratus
    Oct 06, 2014

    Answered my own question. The problem was that the f5 was trying to connect to the pool member via https instead of http between the f5 and the pool member, those members were not configured to accept https traffic.

     

  • Patrik_Jonsson's avatar
    Patrik_Jonsson
    Icon for MVP rankMVP
    Oct 06, 2014

    Hi!

     

    The 302 most likely comes from the server. If the load balancer was the one sending it it'd never appear in the server logs. Whenever you're unsure you can always open up chrome and enable the developer tools console. Then check the response headers of the 302 to find "Server: X".

     

    If X is BigIP the redirect comes from the LB, if it's ie Apache or IIS it'd be the server.

     

    /Patrik