Bug ID 1016909: BIG-IP iRule commands FLOW::this or FLOW::peer can create zombie flows.

Last Modified: Nov 23, 2021

Bug Tracker

Affected Product:  See more info
BIG-IP LTM, TMOS(all modules)

Known Affected Versions:
14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 14.1.2.3, 14.1.2.4, 14.1.2.5, 14.1.2.6, 14.1.2.7, 14.1.2.8, 14.1.3, 14.1.3.1, 14.1.4, 14.1.4.1, 14.1.4.2, 14.1.4.3, 14.1.4.4, 15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2, 15.0.1.3, 15.0.1.4, 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 16.0.0, 16.0.0.1, 16.0.1, 16.0.1.1, 16.0.1.2, 16.1.0, 16.1.1, 16.1.2

Opened: May 07, 2021
Severity: 3-Major

Symptoms

Keeping a variable reference to FLOW::this or FLOW::peer in iRules can result in zombie connection flows that are never removed. TMM memory use for 'connflow' and 'tclrule_pcb' are high, and do not match the number of current connections reported by the system.

Impact

Increased memory use in TMM, which can eventually result in a TMM crash or traffic disruption while connections are removed using the connection sweeper.

Conditions

-- iRule that uses FLOW::this or FLOW::peer, and stores the result of one of those commands into a variable.

Workaround

Do not retain the result of 'FLOW::this' or 'FLOW::peer' in a variable in an iRule. Instead, either: 1. Use the variable directly, i.e.: log local0.warning: "The flow is [FLOW::this]" 2. Unset the variable when done, i.e.: set flow [FLOW::this] log local0.warning: "The flow is $flow" unset flow If a system is already affected by this issue, the only way to free that memory is to restart TMM.

Fix Information

None

Behavior Change