For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

chenchiiren_213's avatar
chenchiiren_213
Icon for Nimbostratus rankNimbostratus
May 16, 2017

HTTP Payload Log

I want to analyze http response content. So, i wrote an irule code as below:

 

when HTTP_REQUEST {
  set replace_content 1    
  HTTP::header remove "Accept-Encoding"
    if { [HTTP::version] eq "1.1" } {
      if { [HTTP::header is_keepalive] } {
        HTTP::header replace "Connection" "Keep-Alive"
      }
      HTTP::version "1.0"
    }
  }

when HTTP_RESPONSE {
  if {$replace_content equals "1"} {   
    if {[HTTP::header exists "Content-Length"] && [HTTP::header "Content-Length"] <= 1048576}{
      set content_length [HTTP::header "Content-Length"]
    } else {
      set content_length 1048576
    }
   Check if $content_length is not set to 0
    if { $content_length > 0} {
      HTTP::collect $content_length
    }
  }
}

when HTTP_RESPONSE_DATA {
  if {$replace_content equals "1"} {
    set payload  [HTTP::payload]
    log $payload
  }
}

 

But payload log as the image, how fix it ~

 

application delivery
iRules
LTM

2 Replies

  • tatmotiv's avatar
    tatmotiv
    Icon for Cirrostratus rankCirrostratus
    May 16, 2017

    Why don't you exclude images in your last event, e.g. like that:

     

    when HTTP_RESPONSE_DATA {
  if {$replace_content equals "1"} {
    if { not ([HTTP::header "Content-Type"] starts_with "Image/") } {
        set payload  [HTTP::payload]
        log $payload
    }
  }
}

     

  • Jad_Tabbara__J1's avatar
    Jad_Tabbara__J1
    Icon for Cirrostratus rankCirrostratus
    May 16, 2017

    You can see what "Content-Type" you are printing by logging the "Content-Type" header using

     

    when HTTP_RESPONSE_DATA {
 if {$replace_content equals "1"} {

   set payload  [HTTP::payload]
   log "Content-Type: [HTTP::header Content-Type]"
   log  $payload
   } 
  }

     

    If you need to print only readable "text" you may limit logging to "text" content-type by adding one condition :

     

        when HTTP_RESPONSE {

    if { ($replace_content equals "1") AND ([HTTP::header "Content-Type"] contains "text") }
    {   
     ...

     

    Regards