Bug ID 756932: iRule command 'ACCESS::session data get -secure' can fail when evaluating empty variables

Last Modified: Nov 15, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP APM(all modules)

Known Affected Versions:
13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4, 13.1.1.5, 13.1.3, 13.1.3.1, 13.1.3.2, 14.0.0, 14.0.0.1, 14.0.0.2, 14.0.0.3, 14.0.0.4, 14.0.0.5, 14.0.1, 14.0.1.1, 14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.4, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 15.0.0, 15.0.1

Opened: Jan 29, 2019
Severity: 3-Major

Symptoms

Use of the iRule command 'ACCESS::session data get -secure <empty variable>' might fail intermittently, which might result in BIG-IP traffic processing failures and a Tcl error logged in /var/log/ltm: err tmm2[22011]: 01220001:3: TCL error: /Common/sp_irule <HTTP_REQUEST> - variable lookup failed (line 1)Illegal argument (line 1) (line 1) invoked from within "ACCESS::session data get -secure "session.saml.last.attr.name.foo"".

Impact

Connection drop.

Conditions

Use of -secure flag to get data from an empty variable from ACCESS::session inside iRules.

Workaround

Use an iRule catch statement.

Fix Information

None

Behavior Change