For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Sumanta_88744's avatar
Sumanta_88744
Icon for Cirrus rankCirrus
Jun 24, 2016

i Rule for extracting specific value from http payload and using it for UIE persistence

Hi Experts

 

What would be the iRule code for identifying and extracting a particular field from http payload and using it for creating UIE persistence?

 

  http.request.line == "X-3GPP-Intended-Identity: \"sip:xxxxxx@ims.mnc---.mcc---.3gppnetwork.org\"\x0d\x0a".

The above can be used as a filter for checking sessions from pcap files in Wireshark.

 

The below value will change for each new session from a new client and based on it, the F5 will create persistence table.

 

 "xxxxxx@ims.mnc---.mcc---"
application delivery
iRules
LTM

1 Reply

  • cjunior's avatar
    cjunior
    Icon for Nacreous rankNacreous
    Jun 30, 2016

    Hi, the "X-3GPP-Intended-Identity" is a request header, isn't?

    If so, I would try like this: 
    when HTTP_REQUEST {
    if { [HTTP::header exists "X-3GPP-Intended-Identity"] } {
        regexp {sip:(.+@\w*\.[\w|-]*\.[\w|-]*)} [HTTP::header value "X-3GPP-Intended-Identity"] dummy key 
        if { [info exists key] } {
            persist uie $key
        }
        unset -nocomplain dummy key
    }
}

    or this (without costly regex):

    when HTTP_REQUEST {
    if { [HTTP::header exists "X-3GPP-Intended-Identity"] } {
        set values [split [lindex [split [HTTP::header value "X-3GPP-Intended-Identity"] :] 1] .]
        set key [concat [lindex $values 0].[lindex $values 1].[lindex $values 2]]
        if { $key ne "" } {
            persist uie $key
        }
        unset values key
    }
}

    I hope it helps.