Forum Discussion

AhmedGalal219_3's avatar
AhmedGalal219_3
Icon for Nimbostratus rankNimbostratus
Jan 17, 2018

tcl error with irule

dears good morning,

i have a many TCL errors that i see in F5 logging caused by irule that someone made it before i work it suppose to be for SIMIS logging . the TCL massage is : Traffic rejected (line 10) (line 10) invoked from within "log x.x.x.x:514 local0. "CEF:0|SIMIS|SIMIS Payload|11.5.2|200|[virtual name]|2|src=$theip dst=[ getfield [IP::server_addr] "%"

and the irule that casing the error is :

timing on when HTTP_REQUEST {

set collect_length 2048 set timeout 2 set TQuery ""

set http_request_time [clock clicks -milliseconds] set theip [ getfield [IP::client_addr] "%" 1 ] set wmethod [HTTP::method] set contype [HTTP::header Content-Type] set conlen [HTTP::header Content-Length] set ReqCookie [HTTP::cookie JSESSIONID]

set TQuery ""

set TQuery2 "" set ReqSession ""

Login

set User ""

set Pload1 ""

switch [HTTP::method] { "GET" { Inspect Query String

  set TQuery  [URI::query "?&[HTTP::query]" hidActionName]

}
"POST" {
   Create a local variable copy of the collection amount
  set collect_length $collect_length

   Create a local variable copy of the static timeout
  set timeout $static::timeout
  if { [HTTP::header Content-Type] eq "application/x-www-form-urlencoded" } {

if {[HTTP::header Content-Length] eq ""}{

     set collect_length $static::collect_length

  } elseif {[HTTP::header Content-Length] <= 0}{

     unset collect_length

  } elseif {[HTTP::header Content-Length] > $collect_length}{

     set collect_length $collect_length

  } else {

      Collect the actual payload length
     set collect_length [HTTP::header Content-Length]

  }

   If the POST Content-Length isn't 0, collect (a portion of) the payload
  if {[info exists collect_length]}{

     HTTP::collect $collect_length
  }

}

  }   
}

}

when HTTP_REQUEST_DATA {

set TQuery [URI::query "?[HTTP::payload]" hidActionName] set User [URI::query "?[HTTP::payload]" txtSIN] set Pload1 [URI::query "?[HTTP::payload]"]

set TQuery2 [URI::query "?&[HTTP::query]" hidActionName]

HTTP::release

if {$TQuery eq ""}{

set TQuery $TQuery2

}

}

when HTTP_RESPONSE {

if {!($TQuery eq "")}{

set RespCookie [HTTP::cookie JSESSIONID] if {($RespCookie eq "")}{ set RespCookie $ReqCookie set ReqSession "Client Sent" }

set http_response_time [ clock clicks -milliseconds ]

log x.x.x.x:514 local0. "CEF:0|SIMIS|SIMIS Payload|11.5.2|200|[virtual name]|2|src=$theip dst=[ getfield [IP::server_addr] "%" 1 ] cn1=[expr {$http_response_time} - {$http_request_time}] cn2=$conlen requestMethod=$wmethod cs1=$TQuery cs2=$RespCookie cs3=$User cs5=$Pload1" }

}

i actually dont understand what is this irule function and why it is rejecting traffic in (((( set wmethod [HTTP::method] )))) line !!!!

1 Reply

  • The Event name in the log may be HTTP_RESPONSE!

    And the line number is from the beginning of the event!

    The error may be

    [expr {$http_response_time} - {$http_request_time}]    
    

    Replace it with

    [expr {$http_response_time - $http_request_time}]