Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

amolari's avatar
amolari
Icon for Cirrostratus rankCirrostratus
Aug 31, 2015

issue with STREAM macthing

hi

trying to have Password Manager Pro working in APM Portal mode. I have such response from server

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Strict-Transport-Security: max-age=7776000; includeSubdomains
X-FRAME-OPTIONS: SAMEORIGIN
Cache-Control: no-cache
Content-Type: text/html;charset=UTF-8
Content-Length: 7444
Date: Wed, 26 Aug 2015 15:20:26 GMT



    
[...]
function newRDP(params)
{
    // var w = 1176, h = 551, server_bpp = 16;
    // var w = 1280, h = 780, server_bpp = 16;
    //var w = 1280, h = 610, server_bpp = 16;
    var w = window.innerWidth-10, h = window.innerHeight-10, server_bpp = 16;

    var protocol = ("https:" == location.protocol) ? "wss://" : "ws://";// No I18N
    var r = svManager.getInstance(); 
    params = params + "&mapClipboard=on";//No I18N
    r = new svGlobal.Rdp( protocol + 'pmanagerpro.customer.com'+ ":"+7273+"/RDP?" + params, w, h, server_bpp);// No I18N
    //alert(params + ' ' +w + ' ' +h);
    //console.log(params + ' ' +w + ' ' +h);
[...]

want to match

'pmanagerpro.customer.com'+ ":"+7273+"/RDP?"

Wrote the stream irule

when HTTP_REQUEST {
STREAM::disable
HTTP::header remove Accept-Encoding
}

when ACCESS_ACL_ALLOWED {
STREAM::disable
HTTP::header remove Accept-Encoding
}



when HTTP_RESPONSE {

set toreplace "\'pmanagerpro.customer.com\'+ \":\"+7273+\"/RDP?"
set replacestring "\'1.1.1.1/f5-w-68747xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx$$/RDP?\'"
STREAM::disable

if {[HTTP::header Content-Type] contains "text"}{     
   STREAM::expression "@$toreplace@$replacestring@"
    STREAM::enable
log local0. "string1= $toreplace    &&&&&  string2= $replacestring"
}
}

when enabled, the logging shows the

toreplace
variable be exactly what I want to match. But the match doesn't work (client gets the original content)

Thank you

Alex