For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

rsacheen's avatar
rsacheen
Icon for Nimbostratus rankNimbostratus
May 16, 2018

HTTP::collect does not function as expected

iRule written below does not collect the specified amount (1024 Bytes) of payload data. Am I missing something here? When I debug the payload contents, the chunked payload size amounts to only about ...
application delivery
iRules
LTM
youssef1's avatar
youssef1
Icon for Cumulonimbus rankCumulonimbus
May 16, 2018

Hi,

I think that your behaviour is correct. let me explain.

When you specify 1024 Bytes, F5 will collects the amount of data that you specify. If the specified amount of data exceeds the amount in the Content-Length response header, only the smaller amount will be collected.

https://devcentral.f5.com/wiki/iRules.HTTP__collect.ashx

So If your request is chunked F5 will collexts only the smaller amount so 869 bytes.

For information, Chunking is a concept introduced in HTTP/1.1 in order to reduce the amount of local storage required on the web server for sending responses.

So in your case if you want to see collect data to 1024 bytes you have to Force the server to HTTP/v1.0 prevents chunking...

 The following example includes collection counter / recollect logic to process payloads > 1MB in size. (Untested, may not be optimal -- please update with improvements.)

when HTTP_REQUEST {
   Don't allow data to be chunked
  if { [HTTP::version] eq "1.1" } {
    if { [HTTP::header is_keepalive] } {
      HTTP::header replace "Connection" "Keep-Alive"
    }
    HTTP::version "1.0"
  }
  set collected 0
}

https://devcentral.f5.com/questions/request-response-chunking

Keep me update please.

Regards