Forum Discussion
ouch_32572
Nimbostratus
Mar 19, 2009irule to rewrite steam in request
Hi All,
I have an issue that i have manged to resolve on another Lb (zxtm)
I need help translating my rule into an irule for f5.
how do i rewite the stream on an incomming request (before it gets sent to the pool)
here is my zxtm rule.
Read the entire request body
$body = http.getBody();
$body = string.regexsub( $body, "https://10.104.30.55", "http://10.104.30.55", "gi" );
It is pretty basic,
in english..
i want to get the body of the request and replace https: with http:
here is what i think the rule should look like, is it correct?
when HTTP_REQUEST {
Disable the stream filter by default
STREAM::disable
STREAM::expression "@https://10.104.30.55@http://10.104.30.55@"
Enable the stream filter for this request only
STREAM::enable
}
32 Replies
- ouch_32572
Nimbostratus
Hi,
01070151:3: Rule [req_rep] error:
line 10: [parse error: PARSE syntax 381 {syntax error in expression " info exists content_length ": extra tokens at end of expression}] [{ info exists content_length }] - hoolio
Cirrostratus
Sorry, I had typos in the info exists content_length lines. They should be wrapped in square brackets:
if { [info exists content_length] } {
Aaron - ouch_32572
Nimbostratus
Hi,
dees this rule need a HTTP::release at the end?
from http://devcentral.f5.com/Wiki/default.aspx/iRules/HTTP__release.html
HTTP::collect, the event (HTTP_REQUEST_DATA or HTTP_RESPONSE_DATA) will not fire without HTTP::release being called (at least implicitly).
Regards
Garry - hoolio
Cirrostratus
You shouldn't need to use HTTP::release in HTTP_REQUEST_DATA:
http://devcentral.f5.com/Wiki/default.aspx/iRules/HTTP__release.html
Unless a subsequent HTTP::collect command was issued, there is no need to use the HTTP::release command inside of the HTTP_REQUEST_DATA and HTTP_RESPONSE_DATA events, since (in these cases) the data is implicitly released.
Aaron - ouch_32572
Nimbostratus
Hi,
I have tested the rule, the page flows through but i dont get the image that is posted in the form uploaded.
when HTTP_REQUEST {
Check if request is a POST
if {[HTTP::method] eq "POST"}{
Trigger collection for up to 1MB of data
if {([HTTP::header exists "Content-Length"]) && ([HTTP::header "Content-Length"] <= 1000000)}{
set content_length [HTTP::header "Content-Length"]
} else {
set content_length 1000000
}
if { info exists $content_length } {
HTTP::collect $content_length
}
}
}
when HTTP_REQUEST_DATA {
Replace https://... with http://... in the payload
HTTP::payload replace 0 [HTTP::payload length] [string map -nocase "https://10.104.30.55 http://10.104.30.55" [HTTP::payload]]
} - hoolio
Cirrostratus
What kind of error/problems do you see? Can you post an anonymized copy of the request headers and body (you can get this using a browser plugin like HttpFox for FF or Fiddler for IE.
Maybe the problem is that non-text POST requests are being modified. It might be good to add a check so that only POST requests with a Content-Type starting with text are rewritten:
if {[HTTP::method] eq "POST" && [HTTP::header Content-Type] starts_with "text"}{
Or is the request a multi-part form upload where the image data is being sent along with the text you're trying to rewrite? If so, the string map command might be corrupting the encoded binary content. You could try using regsub instead:
HTTP::payload replace 0 [HTTP::payload length] [regsub -all "https://10.104.30.55" [HTTP::payload] "http://10.104.30.55"]
Anyhow, if you can provide more detail on what's not working and a sample of the requests, I could more detailed suggestions.
Aaron - ouch_32572
Nimbostratus
Hi All,
I was getting the headers in order to paste them here when i noteced a double replace. (https://10.104.30.55/10.104.30.55/) which in turn makes (GET /10.104.30.55/@@A07A8D93C5E6F89540D8D494CBE5A933/courses/1/support/content/_235847_1/embedded/big_ub_weblearn2.jpg HTTP/1.1) incorrect
HTTP/1.x 200 OK
Date: Mon, 30 Mar 2009 12:32:01 GMT
Server: Replaced
Cache-Control: private, max-age=0, no-store, must-revalidate
Last-Modified: Mon, 30 Mar 2009 12:32:01 GMT
Expires: Sun, 30 Mar 2008 12:32:01 GMT
X-testapp-product: test-app™ 7.3.230.0
Set-Cookie: session_id=A07A8D93C5E6F89540D8D494CBE5A933; Path=/
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html;charset=UTF-8
----------------------------------------------------------
https://10.104.30.55/10.104.30.55/@@A07A8D93C5E6F89540D8D494CBE5A933/courses/1/support/content/_235847_1/embedded/big_ub_weblearn2.jpg
GET /10.104.30.55/@@A07A8D93C5E6F89540D8D494CBE5A933/courses/1/support/content/_235847_1/embedded/big_ub_weblearn2.jpg HTTP/1.1
Host: 10.104.30.55
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-gb,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: https://10.104.30.55/webapps/wysiwyg/ch1/inspicture_proc2.jsp?course_id=_55340_1
Cookie: __utma=46131897.4054063774627931000.1232525019.1232525019.1232525019.1; __utmz=46131897.1232525019.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); JSESSIONID=C579F3709C577B0FCC35F40E5C776DD1.root; session_id=A07A8D93C5E6F89540D8D494CBE5A933
HTTP/1.x 404 Not Found
Date: Mon, 30 Mar 2009 12:32:02 GMT
Server: NotReplaced
Last-Modified: Wed, 23 Jul 2008 14:16:50 GMT
Etag: "2c464-a7d-48873d52;49b8fe09"
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
Content-Type: text/html
Transfer-Encoding: chunked - hoolio
Cirrostratus
Which iRule are you testing now? Are you using a stream filter and iRule and/or HTTP::collect? What is your search/replace strings? If you're only replacing http://10.104.30.55 with https://10.104.30.55 on requests and the opposite on responses, I'm not sure how the URI in an image reference would be rewritten to /10.104.30.55.
Aaron - ouch_32572
Nimbostratus
Hi,
I am testing the rule with...
HTTP::payload replace 0 [HTTP::payload length] [regsub -all "https://10.104.30.55" [HTTP::payload] "http://10.104.30.55"]
I made a slight mistake in the rule so i know why it was putting in the double replace.
This is what i did wrong
HTTP::payload replace 0 [HTTP::payload length] [regsub -all "https://10.104.30.55" [HTTP::payload] "10.104.30.55"]
Anyway the rule is still corrupting any binary objects that are sent in the post. Fron the look of the headers everything is posted as it should be, the replace is happening ok and it works great if i upload a text file. But with images or pdf's for instace i just get a blank/missing file. With images i get the image url repeaded on the screan and FF lists it as an image of the correct type and filesize but with dimensions of 0px x 0px
The closest i every got it to working was with the sream rule. This actually showed some of the content of the image but with the rest of it greyed out. I am guessing this was because the content length without the replace was 10996 and after the replace it was set to 4808, so i guess [HTTP::payload length] was 4808. i tried to do an add on the content length
HTTP::header replace "Content-Length" [HTTP::header "Content-Length"] +1 but that gave me an invalid content length error. Maybe this is just a syntax thing that i have wrong.
when HTTP_REQUEST {
if { [HTTP::method] equals "POST" && [HTTP::header exists "Content-Length"] and [HTTP::header "Content-Length"] > 0} {
STREAM::expression "@https://10.104.30.55@http://10.104.30.55@"
HTTP::header replace "Content-Length" [HTTP::payload length]
STREAM::enable
} else {
STREAM::disable
}
} - ouch_32572
Nimbostratus
Hi All,
Does anybody know the syntax for math expresions.
would something like this work?.
when HTTP_REQUEST {
x = [HTTP::header "Content-Length"]
y = 1
if { [HTTP::method] equals "POST" && [HTTP::header exists "Content-Length"] and [HTTP::header "Content-Length"] > 0} {
STREAM::expression "@https://10.104.30.55@http://10.104.30.55@"
HTTP::header replace "Content-Length" [expr {$x+$y}]
STREAM::enable
} else {
STREAM::disable
}
}
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects
