Forum Discussion

Daniel_Schild's avatar
Daniel_Schild
Icon for Nimbostratus rankNimbostratus
Oct 23, 2017

iRule md5 of non ascii character fails

Hi all,

 

I've configured an iRule found here on devcentral to support APM cientless mode with 401 (more or less the one here). It works great except that it fails if the password contains any non ascii character. Digging a bit into it, it seems that the md5 function doesn't seem to correctly md5 sum whenever the string contains any non ascii character, like iso-8859-1 specific.

 

I've tried this on v12.1.2HF1 and v13.0HF2.

 

Is there anything I should configure somewhere or could this be known behaviour or maybe a bug? I can't seem to find anything about this kind of limitation. Any suggested workaround? Any pointers appreciated.

 

application delivery
BIG-IP Access Policy Manager (APM)
iRules
md5
  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Oct 23, 2017

    Hi Daniel,

    the MD5 command is able to handle arbitrary binary data also including high-bit ISO-8859-1/Latin-1 characters (e.g. german umlaute).

    Please post your related iRule code to see where the high-bit characters are getting silently transformed to UTF-8 (the default encoding of TCL). Based on this I'm happy to show you where to place a [binary format A* $utf_input] to revert the UTF-8 encodings back to ISO-8859-1/Latin-1...

    Cheers, Kai

  • Daniel_Schild's avatar
    Daniel_Schild
    Icon for Nimbostratus rankNimbostratus
    Dec 13, 2017

    Thank you very much for your efforts.

     

    I'm sorry for the late reply but since this was kind of low priority for our customer it has taken some time. Anyway, I ended up asking the support who referenced it as a known issue tracked under ID405209 with title "[RFE] HTTP Auth, in Basic/NTLM mode, does not work with unicode usernames/passwords"

     

    They suggested a workaround "Just create the following "variable assign" after the "HTTP 401 Response" item: [s] session.logon.last.password = set var [mcget -secure {session.logon.last.password}]; set utf8var [encoding convertfrom utf-8 $var]; return "$utf8var""

     

    which worked out for me.

     

    Once again, thank you for your time!