Forum Discussion

Matt_Breedlove_'s avatar
Matt_Breedlove_
Icon for Nimbostratus rankNimbostratus
Jun 19, 2014

Extra fields returned in tcl split inside proc

Noticing extra fields returned when using tcl split inside a proc. The proc produces a result string that is tilde delimited. Format like this integer~string~string ex. 0~?wsdl~solid This string is constructed and then returned in an inline split. When I access the indexed fields with lindex I am seeing there are actually 6 fields, not 3 as I would expect.

Here is what the logs show me for what I put into the proc and what i get back, but for some reason the log command is not having an effect inside the proc. It was before, not now, not sure why. Im guessing its a logger/proc bug.

At any rate, here is log output

: CONFl4~~0 {} {} ?wsdl {} {} solid
: CONFl3~?wsdl~0 {} {} ?wsdl {} {} solid
: CONFl0~0~0 {} {} ?wsdl {} {} solid
: CONFdemo-tools-obliterate.acme.com~/?wsdl

The bottom is the earlier log. You can see the inbound HTTPHOST and HTTPURI (logged with tilde delimiter to separate them). On the CONFlx lines it shows the x field number and the last string on each CONFlx line is the original returned split string/list showing the actual fields. I only submit the HTTPQUERY to the proc to process in this case because I am manually setting the rest of the URI statically later, so only need to check the query string. Notice that CONFl3 has my query string, instead of CONFl1 as I would expect from this proc string going into the split: 0~?wsdl~solid

Initially I was using a triple tilde to split thinking that was how tcl split would see it (like perl split) but no, and I thought ah, the extra tildes explain my extra null fields in the returned array. But even going down to one tilde had literally no effect on the extra fields. Then I thought, Ah, must be the surrounding double quotes I used to quote the tilde(s), they must be being interpreted as delimiters in irules proc, even though in classic tcl they are not. However, even that change made no difference! So I am stumped. I would of course much prefer to double quote the split string, if i can in irules proc tcl

Here is the proc in the current state, with unquoted single tilde at the bottom in the return/split

proc fully_decode_urx { urx max } {
   set ourx $urx;
   if { [string length $urx] != "0" } { 
      set cnt 0;set tmpurx [URI::decode $urx]
      while { $urx ne $tmpurx && $cnt < $max } {
         set urx $tmpurx
         set tmpurx [URI::decode $urx]
         incr cnt
      }
      if {$cnt equals $max} {
         log local0. "EncErr URL string still encoded after $max passes"
         set goback 100~$ourx~encblown
      } elseif { $tmpurx matches_regex {^.*=(\.\.|/)[[A-Za-z0-9./]*]*.*$} } {
         log local0. "InjDet URL string $tmpurx appears to be an injection attack"
         set goback 200~$ourx~injectdetect
      } else {
         set goback $cnt~$tmpurx~solid
      }
   } else {
      log local0. "Urxnul URL string is null ~$ourx~"
      set goback 99~$ourx~Urxnul
   }
   log local0. "disco2 goback=$goback"
   return [split $goback ~]
}

I am accessing the returned value of the proc outside the proc like this:

[lindex $newquery 0]
[lindex $newquery 1]
[lindex $newquery 2]

etc

$newquery is the value of the returned proc split

I am loathe to just pretend that field 3 is field 1 without understanding the nature of this issue more fully particularly since proc's are still new'sh

Any help would be appreciated.

Matt

3 Replies

  • So it looks like the issue maybe was the triple tilde, but due to some very odd Proc/Irule caching in the LTM it was acting as if the triple tilde was still there. After I renamed the proc and used a single tilde those extra fields in the TCL list disappeared. Sigh, I spent a lot of time on this today only be blindsided by this bizarre proc/irule caching behaviour
  • So it looks like the issue maybe was the triple tilde, but due to some very odd Proc/Irule caching in the LTM it was acting as if the triple tilde was still there. After I renamed the proc in the irule and used a single tilde those extra fields in the TCL list disappeared.

     

    Posting to answers (versus comments) so this can be seen as answered