For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Nikoolayy1's avatar
Nikoolayy1
Icon for MVP rankMVP
Aug 16, 2022

Is it possible to insert HTTP payload in an ICAP reply or to change the status code?

Hello,   I see that some implementations of ICAP may by mistake not return an HTTP payload to the F5 Internal Virtual server but they have ICAP headers that a virus has been detected.   For n...
application delivery
security
Xavier_Baugniet's avatar
Xavier_Baugniet
Icon for Altocumulus rankAltocumulus
Jan 11, 2023

Hello Nikoolayy1

 

Indeed, your problem and mine are different.

As I wrote HTTP::respond is not supported in HTTP_RESPONSE_RELEASE. Even if it looks to work, it shouldn't. I edited my previous post to add link for documentation where you can find the info.

Sad thing is the F5 doesn't trigger an error when writing the iRule with this command, while it does if I use HTTP::redirect e.g..

The best place would be in the ICAP_REPONSE event, see https://clouddocs.f5.com/api/irules/ICAP_RESPONSE.html, but I didn't yet found the way to modify the payload here.

Nikoolayy1's avatar
Nikoolayy1
Icon for MVP rankMVP
Jan 11, 2023

From my talks with support when they say HTTP::respond is not supported in HTTP_RESPONSE_RELEASE is actually that you can't add or modify the HTTP body, so adding HTTP header to redirect works as it is not part of the body.

 

About "The best place would be in the ICAP_REPONSE event" yup as I tested with TCP::respond it just does not work and you can't use HTTP::respond in an icap event so I gave up 😀