Forum Discussion

Richard__Harlan's avatar
Richard__Harlan
Historic F5 Account
Feb 10, 2006

Possable Rule crashing Unit

First off I opened a case with support. Just was hope one of the iRules export would see a problem with the rule. If seem every time we have user testing there site witch has these rule attach to it it causes the bigip to core. Attach are the rules. Thanks

 

 

gzip_stop {

 

when HTTP_REQUEST {

 

if { [HTTP::header exists "Accept-Encoding:"] } {

 

HTTP::header replace "Accept-Encoding:" deflate

 

log "header changed"

 

}

 

}

 

}

 

 

WindChill_HTTP_Links {

 

when HTTP_REQUEST {

 

set check_content 1

 

 

Don't allow data to be chunked.

 

if {[HTTP::version] == "1.1"} {

 

if {[HTTP::header is_keepalive]} {

 

Adjust the Connection header.

 

HTTP::header replace "Connection" "Keep-Alive"

 

}

 

HTTP::version "1.0"

 

}

 

}

 

 

 

when HTTP_RESPONSE {

 

if {$check_content == 1} {

 

set replace_now 1

 

log "replace now"

 

Calculate the amount to collect

 

set content_length 0

 

if {[HTTP::header exists "Content-Length"]} {

 

set content_length [HTTP::header "Content-Length"]

 

}

 

 

If the header is missing, use a sufficiently large number

 

if {$content_length == 0} {

 

set content_length 4294967295

 

}

 

HTTP::collect $content_length

 

log "collect"

 

 

}

 

}

 

 

when HTTP_RESPONSE_DATA {

 

log "Response"

 

set payload [HTTP::payload [HTTP::payload length]]

 

set windchilllinks "https://cfwctest3.deere.com"

 

Find HTTP Links and change to HTTPS links

 

if { [regsub -all -nocase {http://cfwctest3.deere.com} $payload $windchilllinks new_response] > 0 } {

 

Replace the content if there was any matches

 

HTTP::payload replace 0 [HTTP::payload length] $new_response

 

log "data changed"

 

}

 

}

 

}

 

 

 

6 Replies

  • Have you put any logging in place to determine which part of your rules is the culprit. The one thing that sticks out at first glance is that you are using regsub to build an entire new copy of the payload which could be quite memory intensive depending on the size of your response. My guess is it's either the regsub or HTTP::payload replace but there's now way to know without some logging.

    There are alternates to using regsub on the entire payload. You could use regexp with the "-indices" argument to return the indices in the source content, then call the HTTP::payload replace command for each index of matched content. This is illustrated in this post on my blog:

    http://devcentral.f5.com/weblogs/joe/archive/2005/07/27/1398.aspx

    Click here

    The processing of the response data would look something like this:

    when HTTP_RESPONSE_DATA {
      set find "http://cfwctest3.deere.com"
      set replace "https://cfwctest3.deere.com"
      set offset 0
      set diff [expr [string length $replace] - [string length $find]]
       Get indices of all instances of find string in the payload
      set indices [regexp -all -inline -nocase -indices $find [HTTP::payload]]  
      foreach idx $indices {
        set start [expr [lindex $idx 0] + $offset]
        set end [expr [lindex $idx 1] + $offset]
        set len [expr {$end - $start + 1}]
         replace the instance of find with the contents of replace
        HTTP::payload replace $start $len $replace
         modify offset if the replace string is larger or smaller
         than find.
        incr offset $diff
      }
    }

    But, unless the regsub or HTTP::payload replace commands are the culprit, this solution won't help you (aside from optimizing memory usage).

    -Joe
  • Richard__Harlan's avatar
    Richard__Harlan
    Historic F5 Account
    It does look like we are running into the 4mb rule limit for memory. How much memory would you change save us? Also if we convert to the Stream profile would be be able to get around the 4mb limit? Thanks
  • I guess I should have mentioned the stream profile. Thinking of this now, it's probably your best option.

     

     

    -Joe
  • You can turn on time profiling on a rule with the "timing on" command

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules.timing

     

    Click here

     

     

    But this will not present memory usage, just execution times. I don't believe that there is a way to show memory usage on a rule by rule basis.

     

     

    -Joe