Grab cookie contents and insert it as another.

The usage for HTTP::cookie insert is the following:

HTTP::cookie insert “name” “value” [“path” ] [“domain” ][“version” <0 | 1 | 2>]

So, for your example, you need to add the "name" and "value" arguments like this:

HTTP::cookie insert name auth_user value $auth_user

This should get you past the syntax error, but you'll still need to validate whether the value of $auth_user is as expected.

-Joe

Joe, It passed syntax but when I try to display the value in the logs, it is always empty. I can see that value in the tcpdump which shows:

 

 

txtUsernameView=556987&txtUsername=00556987&Password=xxxxxxx&target..etc

 

 

I am trying to get the value in the txtUsername= and put that value in the auth_user variable. Actually, I see that value on the response - not request. Any suggestions? My ltm logs show this:

 

 

Apr 26 16:29:11 tmm tmm[27159]: 01220002:6: Rule User_insert :

 

Apr 26 16:29:11 tmm tmm[27159]: 01220002:6: Rule User_insert :

 

Apr 26 16:29:17 tmm tmm[27159]: 01220002:6: Rule User_insert :

 

Apr 26 16:29:17 tmm tmm[27159]: 01220002:6: Rule User_insert :

 

Apr 26 16:31:54 tmm tmm[27159]: 01220002:6: Rule User_insert :

 

Apr 26 16:32:10 tmm tmm[27159]: 01220002:6: Rule User_insert :

 

 

My rule in the Big IP is:

 

 

when HTTP_RESPONSE {

 

set auth_user [findstr [HTTP::cookie txtUsername] "txtUsername" 12 "&" ]

 

HTTP::cookie insert name authuser value $auth_user

 

log "$auth_user"

 

}

 

 

Thanks for your help Joe.

I would start by first logging the value of the cookie itself

 set cookie_value [HTTP::cookie txtUsername]  
 log "txtUserName Value: $cookie_value"

It's unclear to me why you are doing a findstr within the value of the cookie itself (unless you are trying to search at an offset within the cookie). It kind of looks like you are trying to parse the entire HTTP cookie for your entry which is what I believe the HTTP::cookie command does for you. The HTTP::cookie command will return the value of the named cookie which may be all you need. Give it a shot and let us know the contents of your the txtUsername cookie and we can diagnose what's going on with findstr (or if you need it).

-Joe

Joe, It appears that the information I am trying to get is in the payload. I tried to get cookie and header and neither one work. It has to be in the payload. I am pasting the output of the tcpdump where I captured the transaction. You will see a line right after the Cookie: SMIDENTITY= and it starts with txtUsernameView= What I am trying to get is the second value which is txtUsername=00556987 and store the part after the = in a cookie. I have tried everything I know to try to capture this information. I am hoping you can help me out. Thanks.

 

 

POST /SiteminderAgent/Forms/Login/login.fcc HTTP/1.1

 

 

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*

 

 

Referer: http://login.bx05.aa.com/AACMApp/aacm_login/Login2.jsp?DYNAPP=JETNET&TYPE=33554433&REALMOID=06-3dd14351-13b7-00bd-0000-0fb600000fb6&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$xlJw41cJE2Lt7cV2xXV8iexV9FKte%2fdzlVCtGXhmS%2fFCI3Ccg0ToAd91AhcF1bw%2bcEMe2ZRPCeU%3d&TARGET=$SM$http%3a%2f%2fetravel00001%2ey1%2eetravel%2ebx05%2eaa%2ecom%2fNonRev2App%2findex%2ejsp%3fheader%3dplanner

 

 

Accept-Language: en-us

 

 

Content-Type: application/x-www-form-urlencoded

 

 

Accept-Encoding: gzip, deflate

 

 

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)

 

 

Host: login.bx05.aa.com

 

 

Content-Length: 274

 

 

Connection: Keep-Alive

 

 

Cache-Control: no-cache

 

 

Cookie: SMIDENTITY=xmiytBBnyHEnz8vzjZ0ePDVZbMm4/YWLHVOhDHi9svmTMHJAFBUq1TQGM/QZzPlvkhTtcHBjIoQX7oiMlIze0k2jFlhf/94jDxFXb9XcJA+uBlJGAe19HPhYmh78zAMb1ZnFtLdla8EwvywAAIZJ7SUVRVZdPCuOyJxR7bP2x+0aQzDP7PLLZG4hF3KLxIZghfXfom4ykgG3Y/VsnX/oSxFukWbQKJ3S4Pempl4xwPiKeqSyO+xUEXLxaZVp5koUU7T5v43YhFDt0d8IJJfbm7VA285nz1nUTtiqaUVWntibNLx5BY4qrjH05taFgyIFdVPstsTAkVMJEDHiJx9BT+PgHRcZ3e6pdSHa7tbZ0kQAUQtH8S8hklFY6Y4SBa9PIY21RKzcL8+4hcCU7eECHQxiWMTfEWZ6OKasYqxHDVH0n/YeuhWibKMEgu0tFX0kPB3Vjxx57O0Pyq+0V9Pp0COAEwHmZ9v0yOavRxGluO3IggAPYrk4tVXa4wV0qhCU7P3+ewGayiXGgwFUO5AOVaTrzH82KVdG9OyhlxKjNIScJ4Sqil2u4wltAjWL9CrluVlbk9Vrb7rHnajxa77JJ/FoS43bNa4gEEizdceggd7Of77E4MM9+ePz3ZPLtd8WSdCuLM8x5pM=; JSESSIONID=0DOGC33V5H1J0CUXH20SFEY

 

 

 

***** The next line is what I am trying to capture ****

 

txtUsernameView=556987&txtUsername=00556987&Password=sunshine69&target=%2FAACMApp%2Faacm_register%2Ffps6Redirect.jsp%3Ffinalpg%3Dhttp%253a%252f%252fetravel00001%252ey1%252eetravel%252ebx05%252eaa%252ecom%252fNonRev2App%252findex%252ejsp%253fheader%253dplanner&smauthreason=0HTTP/1.1 100

Looks like you've got your contents in the POST data which is indeed part of the HTTP payload. Here's some code to collect the full POST data via the Content-Length header and then it uses findstr to search in the payload data for the txtUsername= string.

 

 

 when HTTP_REQUEST { 
   set clen [HTTP::header Content-Length] 
   HTTP::collect $clen 
 } 
  
 when HTTP_REQUEST_DATA { 
   set authuser [findstr [HTTP::payload $clen] "txtUsername=" 12 "&"] 
   log "txtUserName Value: $authuser" 
 }

 

 

-Joe

Joe, We are getting close but I got this error when I put the rule in the Big IP.

 

 

Apr 27 13:27:54 tmm tmm[27159]: 01220001:3: TCL error: Rule Test_Insert - expected integer but got ""Illegal argument. Invalid integer value (line 1) invoked from within "HTTP::collect $clen"

 

Apr 27 13:27:55 tmm tmm[27159]: 01220001:3: TCL error: Rule Test_Insert - expected integer but got ""Illegal argument. Invalid integer value (line 2) invoked from within "HTTP::collect $clen"

Looks like this may be catching on another non-POST request. Give this a try

 when HTTP_REQUEST { 
   if { [HTTP::header exists "Content-Length"] } {   
     set clen [HTTP::header Content-Length] 
     log "found Content-Length: $clen" 
     if { $clen > 0 } {     
       HTTP::collect $clen 
     } 
   } 
 } 
  
 when HTTP_REQUEST_DATA { 
 set authuser [findstr [HTTP::payload] "txtUsername=" 12 "&"] 
 log "txtUserName Value: $authuser" 
 }

This will only try to extract the Content-Length header if it exists and will only call HTTP::collect if the value is greater than zero. I've also removed the $clen from the HTTP::payload command as it will return the amount collected which is what was indicated int he HTTP::collect command.

Hopefully this gets it...

-Joe

Anytime! Keep us updated with what you are working on...

 

 

-Joe