I am trying to have the load balancer respond as the server. The POST's that are coming in do not require any data returned, but are using the Expect: 100-Continue header. The below works and I see the transaction complete via a tcpdump, but why does the logging of the payload not work? Trying to figure out where the events stack up once taking over as the server. [CODE] when HTTP_REQUEST { if { [HTTP::host] eq "mycompany.com" }{ HTTP::collect [HTTP::header "Content-Length"] if { [HTTP::header Expect] eq "100-continue" }{ HTTP::respond 100 noserver } } } when HTTP_REQUEST_DATA { log local0. "[HTTP::payload]" } [/CODE]

was http_request_data event executed? did you see blank line of log?

Yes, there is a blank log message suggesting the event did fire.

did you see content-length header and payload in the tcpdump?

Yes, there was a content-length and a one line payload in the tcpdump

this is my testing. [root@ve10:Active] config b virtual bar list virtual bar { snat automap pool foo destination 172.28.19.79:80 ip protocol 6 rules myrule profiles { http {} tcp {} } } [root@ve10:Active] config b pool foo list pool foo { members 200.200.200.101:80 {} } [root@ve10:Active] config b rule myrule list rule myrule { when HTTP_REQUEST { if { [HTTP::host] eq "mycompany.com" }{ HTTP::collect [HTTP::header "Content-Length"] if { [HTTP::header Expect] eq "100-continue" }{ HTTP::respond 100 noserver } } } when HTTP_REQUEST_DATA { log local0. "[HTTP::payload]" } } on client [root@centos251 ~] curl -d "this_is_post_data" http://172.28.19.79 -H "host: mycompany.com" on bigip [root@ve10:Active] config ssldump -Aed -nni 0.0 port 80 New TCP connection 1: 172.28.19.251(43004) <-> 172.28.19.79(80) 1344602578.5274 (0.0012) C>S --------------------------------------------------------------- POST / HTTP/1.1 User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5 Accept: */* host: mycompany.com Content-Length: 17 Content-Type: application/x-www-form-urlencoded this_is_post_data--------------------------------------------------------------- New TCP connection 2: 200.200.200.10(43004) <-> 200.200.200.101(80) 1344602578.5293 (0.0017) C>S --------------------------------------------------------------- POST / HTTP/1.1 User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5 Accept: */* host: mycompany.com Content-Length: 17 Content-Type: application/x-www-form-urlencoded this_is_post_data--------------------------------------------------------------- [root@ve10:Active] config tail /var/log/ltm Aug 10 20:42:58 local/tmm info tmm[4860]: Rule myrule : this_is_post_data

Collect Payload after 100-Continue

nitass
Employee
Aug 10, 2012
was http_request_data event executed? did you see blank line of log?
Brian_69413
Nimbostratus
Aug 10, 2012
Yes, there is a blank log message suggesting the event did fire.
nitass
Employee
Aug 10, 2012
did you see content-length header and payload in the tcpdump?
Brian_69413
Nimbostratus
Aug 10, 2012
Yes, there was a content-length and a one line payload in the tcpdump

nitass

Employee

Aug 10, 2012

this is my testing.

[root@ve10:Active] config  b virtual bar list
virtual bar {
   snat automap
   pool foo
   destination 172.28.19.79:80
   ip protocol 6
   rules myrule
   profiles {
      http {}
      tcp {}
   }
}
[root@ve10:Active] config  b pool foo list
pool foo {
   members 200.200.200.101:80 {}
}
[root@ve10:Active] config  b rule myrule list
rule myrule {
   when HTTP_REQUEST {
   if { [HTTP::host] eq "mycompany.com" }{
      HTTP::collect [HTTP::header "Content-Length"]
      if { [HTTP::header Expect] eq "100-continue" }{
         HTTP::respond 100 noserver
      }
   }
}
when HTTP_REQUEST_DATA {
   log local0. "[HTTP::payload]"
}
}

 on client

[root@centos251 ~] curl -d "this_is_post_data" http://172.28.19.79 -H "host: mycompany.com"

 on bigip

[root@ve10:Active] config  ssldump -Aed -nni 0.0 port 80
New TCP connection 1: 172.28.19.251(43004) <-> 172.28.19.79(80)
1344602578.5274 (0.0012)  C>S
---------------------------------------------------------------
POST / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Accept: */*
host: mycompany.com
Content-Length: 17
Content-Type: application/x-www-form-urlencoded

this_is_post_data---------------------------------------------------------------

New TCP connection 2: 200.200.200.10(43004) <-> 200.200.200.101(80)
1344602578.5293 (0.0017)  C>S
---------------------------------------------------------------
POST / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Accept: */*
host: mycompany.com
Content-Length: 17
Content-Type: application/x-www-form-urlencoded

this_is_post_data---------------------------------------------------------------

[root@ve10:Active] config  tail /var/log/ltm
Aug 10 20:42:58 local/tmm info tmm[4860]: Rule myrule : this_is_post_data

Brian_69413
Nimbostratus
Aug 10, 2012
Why does your SSL Dump not show the 100 status response?

I think part of the problem is that the post data only comes after receiving the 100 response from the server, but it is not a new HTTP request.

Brian_69413

Nimbostratus

Aug 10, 2012

This is what I see on a transaction:


New TCP connection 1: 4.59.146.74(60372) <-> *.*.*.*(80)
1344605329.3721 (0.0066)  C>S
---------------------------------------------------------------
POST /smspostback HTTP/1.1
User-Agent: CDYNE SMSv2
Content-Type: application/x-www-form-urlencoded
Host: mycompany.com
Content-Length: 161
Expect: 100-continue
Connection: Keep-Alive

---------------------------------------------------------------

1344605329.3722 (0.0001)  S>C
---------------------------------------------------------------
HTTP/1.0 100 Continue
Connection: Keep-Alive
Content-Length: 0

---------------------------------------------------------------

1344605329.3789 (0.0066)  C>S
---------------------------------------------------------------
SMSSent=1&MessageID=b99b166b-559a-4a60-ad3b-ac3f0ac09c5c&ReferenceID=&FromPhoneNumber=***********&ToPhoneNumber=***********&SentTime=8%2f10%2f2012+1%3a28%3a49+PM---------------------------------------------------------------

1    1344605334.3497 (4.9708)  C>S  TCP FIN
1    1344605334.3498 (0.0000)  S>C  TCP FIN

Brian_69413
Nimbostratus
Aug 10, 2012
Oh wait, the LB is responding with an HTTP/1.0 response...DOH!

This is why the below hangs...
curl -d "this_is_post_data" http://mycompany.com -H "Expect: 100-continue"
Brian_69413
Nimbostratus
Aug 12, 2012
Does anyone have any ideas on where to capture the continued POST data?

nitass

Employee

Aug 12, 2012

what about this one?

[root@ve10:Active] config  b virtual bar list
virtual bar {
   destination 172.28.19.79:80
   ip protocol 6
   rules myrule
   profiles {
      http {}
      tcp {}
   }
}
[root@ve10:Active] config  b rule myrule list
rule myrule {
   when HTTP_REQUEST {
   if { [HTTP::host] eq "mycompany.com" } {
      HTTP::collect [HTTP::header "Content-Length"]
   }
}
when HTTP_REQUEST_DATA {
   log local0. "[HTTP::payload]"
   if { [HTTP::header Expect] eq "100-continue" } {
      HTTP::respond 100 noserver
   } else {
      HTTP::respond 200 noserver
   }
}
}

 on client
[root@centos251 ~] curl -d "this_is_post_100_data" -i http://172.28.19.79 -H "Host: mycompany.com" -H "Expect: 100-continue"
HTTP/1.0 100 Continue
Connection: Keep-Alive
Content-Length: 0


[root@centos251 ~] curl -d "this_is_post_data" -i http://172.28.19.79 -H "Host: mycompany.com"
HTTP/1.0 200 OK
Connection: Keep-Alive
Content-Length: 0

 on bigip
[root@ve10:Active] config  cat /var/log/ltm
Aug 12 18:23:54 local/tmm info tmm[14353]: Rule myrule : this_is_post_100_data
Aug 12 18:24:12 local/tmm info tmm[14353]: Rule myrule : this_is_post_data

Forum Discussion

Collect Payload after 100-Continue

Recent Discussions

F5 Hotfix

Glucovate Blood Sugar Support Review (2024-2025): Pros, Cons, and Potential Side Effects

Bypass "Bad unescape" in Body POST (ASM, POST, JSON)

URL redirect

Bypass the character for Evasion technique Detected violation

Related Content

HTTP Payload Collection

postman collection

Collect all partition pool member stats with tmsh

Large payload post requests aren't responding

TCP::collect and large TLS v1.3 client hello packets