Last Modified: Oct 17, 2023
Affected Product(s):
BIG-IP APM, Install/Upgrade
Known Affected Versions:
12.1.0, 12.1.1, 12.1.2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4
Fixed In:
13.0.0, 12.1.4.1
Opened: Jun 22, 2016 Severity: 3-Major
Starting in v12.1.1, the CATEGORY::lookup iRule command will no longer accept an HTTP URI in its argument to the command if the BIG-IP system has APM and URL Filtering provisioned or just URL Filtering provisioned along for SSL Bypass decisions. Only a valid hostname can be used and have its category returned. In versions prior to v12.1.1, the following iRule command was valid: when HTTP_REQUEST { set this_uri http://[HTTP::host][HTTP::uri] set reply [CATEGORY::lookup $this_uri] log local0. "Category lookup for $this_uri returns $reply" } Starting in v12.1.1, using the previous example, you must remove the HTTP::uri statement. If an HTTP::uri is provided to the command, the system returns an error similar to the following: err tmm2[12601]: 01220001:3: TCL error: /Common/_1_categ_test <HTTP_REQUEST> - Categorization engine returned an error. invoked from within "CATEGORY::lookup $this_uri" Correcting the iRule for post-v12.1.1 installation, the example must be modified to pass in the HTTP::host only, as follows: when HTTP_REQUEST { set this_uri http://[HTTP::host] set reply [CATEGORY::lookup $this_uri] log local0. "Category lookup for $this_uri returns $reply" } Note: If APM and SWG are licensed and provisioned, the CATEGORY::lookup iRule command will accept an HTTP URI as a part of the argument to the command.
There is an error returned from the command. This can cause errors in existing deployments.
- BIG-IP licensed and provisioned for: o APM and URL Filtering o URL Filtering (used for SSL Bypass decisions in SSL Air-Gap deployments). - An iRule that supplies a URI path to the CATEGORY::lookup iRule command. - Upgrading from pre-v12.1.1 versions that use the CATEGORY::lookup iRule command and use an HTTP::uri or pass in a plain text string that contains anything other than an HTTP hostname.
Update the iRule to only pass an HTTP hostname to the CATEGORY::lookup iRule command
Starting in v12.1.1, the CATEGORY::lookup iRule command will no longer accept an HTTP URI in its argument to the command if the BIG-IP system has APM and URL Filtering provisioned or just URL Filtering provisioned along for SSL Bypass decisions. Only a valid hostname can be used and have its category returned.
Starting in v12.1.1, the CATEGORY::lookup iRule command will no longer accept an HTTP URI in its argument to the command if the BIG-IP system has APM and URL Filtering provisioned or just URL Filtering provisioned along for SSL Bypass decisions. Only a valid hostname can be used and have its category returned. In versions prior to v12.1.1, the following iRule command was valid: when HTTP_REQUEST { set this_uri http://[HTTP::host][HTTP::uri] set reply [CATEGORY::lookup $this_uri] log local0. "Category lookup for $this_uri returns $reply" } Starting in v12.1.1, using the previous example, you must remove the HTTP::uri statement. If an HTTP::uri is provided to the command, the system returns an error similar to the following: err tmm2[12601]: 01220001:3: TCL error: /Common/_1_categ_test <HTTP_REQUEST> - Categorization engine returned an error. invoked from within "CATEGORY::lookup $this_uri" Correcting the iRule for post-v12.1.1 installation, the example must be modified to pass in the HTTP::host only, as follows: when HTTP_REQUEST { set this_uri http://[HTTP::host] set reply [CATEGORY::lookup $this_uri] log local0. "Category lookup for $this_uri returns $reply" } Note: If APM and SWG are licensed and provisioned, the CATEGORY::lookup iRule command will accept an HTTP URI as a part of the argument to the command.