For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

10 Replies

  • Angelo's avatar
    Angelo
    Icon for Nimbostratus rankNimbostratus
    No all the did was change the http get to a fetch....
  • Angelo's avatar
    Angelo
    Icon for Nimbostratus rankNimbostratus
    No all the did was change the http get to a fetch....
  • Angelo's avatar
    Angelo
    Icon for Nimbostratus rankNimbostratus
    No all the did was change the http get to a fetch....
  • Angelo's avatar
    Angelo
    Icon for Nimbostratus rankNimbostratus
    hi

     

     

    this is what i came up with after some reading but i'm not sure if it will work...

     

     

    when CLIENT_ACCEPTED {

     

    TCP::collect

     

    }

     

    when CLIENT_DATA {

     

    if { [TCP::payload] contains "GET" } {

     

    [TCP::payload] replace "FETCH" }

     

    TCP::release

     

    }

     

  • Angelo's avatar
    Angelo
    Icon for Nimbostratus rankNimbostratus
    Hi

     

     

    This is the ssl dump to illstrate what i need to do

     

     

    i need to change GET / HTTP/1.1 to a FETCH / HTTP/1.1

     

     

    New TCP connection 1: 10.190.24.171(52753) <-> 165.148.250.77(80)

     

    1373354965.7354 (0.0050) C>S

     

    ---------------------------------------------------------------

     

    GET / HTTP/1.1

     

    Host: 165.148.250.77

     

    Connection: keep-alive

     

    Cache-Control: max-age=0

     

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

     

    User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116 Safari/537.36

     

    Accept-Encoding: gzip,deflate,sdch

     

    Accept-Language: en-US,en;q=0.8

     

    If-None-Match: "140cda-17d-4dffa0461cccd"

     

    If-Modified-Since: Tue, 25 Jun 2013 12:53:35 GMT

     

     

     

    ---------------------------------------------------------------

     

     

    1 1373354965.7355 (0.0000) S>C TCP RST

     

    New TCP connection 2: 10.190.24.171(52756) <-> 165.148.250.77(80)

     

    1373354965.7441 (0.0030) C>S

     

    ---------------------------------------------------------------

     

    GET / HTTP/1.1

     

    Host: 165.148.250.77

     

    Connection: keep-alive

     

    Cache-Control: max-age=0

     

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

     

    User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116 Safari/537.36

     

    Accept-Encoding: gzip,deflate,sdch

     

    Accept-Language: en-US,en;q=0.8

     

    If-None-Match: "140cda-17d-4dffa0461cccd"

     

    If-Modified-Since: Tue, 25 Jun 2013 12:53:35 GMT

     

     

    ---------------------------------------------------------------

     

     

    2 1373354965.7441 (0.0000) S>C TCP RST

     

    New TCP connection 3: 10.190.24.171(52758) <-> 165.148.250.77(80)

     

    1373354965.7523 (0.0030) C>S

     

    ---------------------------------------------------------------

     

    GET / HTTP/1.1

     

    Host: 165.148.250.77

     

    Connection: keep-alive

     

    Cache-Control: max-age=0

     

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

     

    User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116 Safari/537.36

     

    Accept-Encoding: gzip,deflate,sdch

     

    Accept-Language: en-US,en;q=0.8

     

    If-None-Match: "140cda-17d-4dffa0461cccd"

     

    If-Modified-Since: Tue, 25 Jun 2013 12:53:35 GMT

     

     

    ---------------------------------------------------------------

     

     

    3 1373354965.7524 (0.0000) S>C TCP RST
  • can you try something like this?

    [root@ve10:Active] config  b virtual bar list
    virtual bar {
       snat automap
       pool foo
       destination 172.28.19.252:80
       ip protocol 6
       rules myrule
    }
    [root@ve10:Active] config  b pool foo list
    pool foo {
       members 200.200.200.101:80 {}
    }
    [root@ve10:Active] config  b rule myrule list
    rule myrule {
       when CLIENT_ACCEPTED {
      TCP::collect
    }
    when CLIENT_DATA {
      set payload [TCP::payload]
      if { $payload starts_with "GET" } {
        TCP::payload replace 0 [TCP::payload length] ""
        TCP::payload replace 0 0 [string map {GET FETCH} $payload]
      }
      TCP::release
      TCP::collect
    }
    }
    
    [root@ve10:Active] config  ssldump -Aed -nni 0.0 port 80
    New TCP connection 1: 172.28.20.17(38478) <-> 172.28.19.252(80)
    1373365190.6251 (0.0010)  C>S
    ---------------------------------------------------------------
    GET / HTTP/1.1
    User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
    Host: 172.28.19.252
    Accept: */*
    
    ---------------------------------------------------------------
    
    New TCP connection 2: 200.200.200.10(38478) <-> 200.200.200.101(80)
    1373365190.6263 (0.0010)  C>S
    ---------------------------------------------------------------
    FETCH / HTTP/1.1
    User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
    Host: 172.28.19.252
    Accept: */*
    
    ---------------------------------------------------------------
    
  • Nitass' example will certainly do what you need if it's a simple replacement of the "GET" method string with the word "FETCH". However, FETCH isn't an RFC 2616 (HTTP/1.1) compliant method, and nothing shows up in a search, so I have to assume 1) that your application is just coded to accept this non-standard method, 2) the protocol traffic isn't specifically HTTP-based, and/or 3) there's no indication that the FETCH method's syntax is identical to that of a GET request - in the same way that a GET request is different than a POST request - which is why I asked my original question.
  • Angelo's avatar
    Angelo
    Icon for Nimbostratus rankNimbostratus
    Works like a champion thanks guys... @Nitass so i was on the right track i am learning at least lol.....
  • Angelo's avatar
    Angelo
    Icon for Nimbostratus rankNimbostratus
    @Kevin the developers changed this to see if the F5 could change the propitiatory commands for another application that they are designing