iRule Request - strip sub domains

Question

I'm trying to create an iRule that can be used similar to the following mod rewrite command:&nbsp;
&nbsp;RewriteCond %{HTTP_HOST} ^.+\.(.+)\.mydomain\.com$ [NC]
&nbsp;RewriteRule ^(.*)$ https://%1.mydomain.com$1 [R=301,L]&nbsp;
&nbsp;What we're wanting is anything that hits https://*.sub.mydomain.com to be redirected to https://sub.mydomain.com.  I guess i'm just not sure how to strip everything before sub.mydomain.com from the URL while maintaining whatever is in that first sub domain spot.&nbsp;
&nbsp;Ideally this single rule would work for any of these variants:
&nbsp;https://*.sub1.mydomain.com &gt; https://sub1.mydomain.com
&nbsp;https://*.sub2.mydomain.com &gt; https://sub2.mydomain.com
&nbsp;https://*.whatever.mydomain.com &gt; https://whatever.mydomain.com&nbsp;
&nbsp;If it matters, the virtual server is configured with a wildcard ssl certificate *.mydomain.com so we're trying to avoid customers instinctively adding www. to the beginning of the url and getting a certificate error.&nbsp;
&nbsp;Thanks for helping!&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

hooleylist · Answer

Hi Brett, 
  
 I tried a regex, but it was about 10x less efficient than a couple of string and list operations: 
  
 Simple perf test: 
  
 % time {set host_list [split $host "."]; lindex $host_list [expr {[llength $host_list] -3}]} 1000 
 13 microseconds per iteration 
  
 % time {regexp -inline -nocase {(?:[^.]+\.){0,}([^.]+)\.mydomain\.com} test.mydomain.com} 1000 
 133 microseconds per iteration

when HTTP_REQUEST {
   log local0. "[IP::client_addr]:[TCP::client_port]: [HTTP::method] request to [HTTP::host][HTTP::uri]"
    Split the host header value on periods into a list
   set host_list [split [HTTP::host] "."]
   log local0. "[IP::client_addr]:[TCP::client_port]: Parsed host list $host_list"
    Check if there were more than three fields
   if {[llength $host_list] &gt; 3}{
       Send a redirect with the third to last field from the requested host prepended to .mydomain.com
      HTTP::respond 301 Location "https://[lindex $host_list [expr {[llength $host_list] -3}]].mydomain.com"
      log local0. "[IP::client_addr]:[TCP::client_port]: Redirecting to\
         https://[lindex $host_list [expr {[llength $host_list] -3}]].mydomain.com"
   }
} 
  
 Aaron

brettbeggs_1177 · Answer

Thanks Aaron. 
&nbsp; I ended up having to make one little tweak, adding "https://" to the response code to get it sent over to the correct place. 
&nbsp;  
&nbsp; 
       Send a redirect with the third to last field from the requested host prepended to .mydomain.com
      HTTP::respond 301 Location "https://[lindex $host_list [expr {[llength $host_list] -3}]].mydomain.com"
  
&nbsp;  
&nbsp; The problem now seems to be that the redirect isnt taking place before the request hits the virtual server.  This is causing a certificate error to pop up. Once you add the exception and advance past it, the redirect works like a champ.  I guess on some level that makes sense.  The request has to hit the virtual server before it processes the iRule, but in doing so, causes the certificate exception. 
&nbsp;  
&nbsp; When monitoring the logs, nothing gets logged until after you accept the certificate warning.

hooleylist · Answer

Thanks for the correction on the redirect location protocol.  I assumed you were using this rule on an HTTP VIP.  As you found it's too late to fix this when the client is making an HTTPS request with a hostname that doesn't match the SSL cert.  For HTTPS, LTM needs to decrypt the SSL before viewing the HTTP or sending an HTTP response.  In order to decrypt the SSL, LTM needs to send its cert and complete an SSL handshake.   
&nbsp;  
&nbsp; To fix this, you'd need to correct the client's request before it's made via HTTPS.  So if you can add this iRule to an HTTP VIP you could prevent the insecure cert warning for the HTTPS requests.  Or if clients are expected to make requests directly via HTTPS to the various hostnames, you could create separate A records to resolve the hostnames to different IP addresses. 
&nbsp;  
&nbsp; Aaron

brettbeggs_1177 · Answer

This is so frustrating... 
&nbsp;  
&nbsp; I've decided to apply this iRule to the HTTP virtual server and wanted to add an else statement.  Basically, the first part of the script should run and fix anything with more than 3 levels to the domain name.  I want the else statement to kick in for everything else and simply redirect to https.  Using the code below, i see the stuff show up in the log, but for the life of me, i can't get it to work.  The browser just keeps saying that "The page isn't redirecting properly...Firefox has detected that the server is redirecting the request for this address in a way that will never complete". 
&nbsp;  
&nbsp; Here's the code added... 
&nbsp;  
&nbsp; else { 
&nbsp;   HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]" 
&nbsp;   log local0. "[IP::client_addr]:[TCP::client_port]: Redirecting to https://[HTTP::host][HTTP::uri] without parsing" 
&nbsp; }   
&nbsp;  
&nbsp; Any thoughts on why that keeps failing?

hooleylist · Answer

What do the logs show (/var/log/ltm)?  Is the HTTPS VIP redirecting some or all requests to HTTP? 
&nbsp;  
&nbsp; Aaron

Forum Discussion

iRule Request - strip sub domains

6 Replies

Recent Discussions

F5 terminal - help to run commands - disk space full

vulnerabilities-CVE-2020-16150 & CVE-2013-0169

google autenticator broken barcode

Error while running ansible

ASM instance creation

Related Content

OCSP: Bad Request

Replace an header authorization request with policy or iRule doesn't work ...

Cannot edit "per-request policies" Request status 500

multiple requests in single tcp connection via irule without oneconnect

Cannot ping node IP when configured in route-domain.