For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

amolari's avatar
amolari
Icon for Cirrostratus rankCirrostratus
Aug 31, 2015

issue with STREAM macthing

hi

trying to have Password Manager Pro working in APM Portal mode. I have such response from server

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Strict-Transport-Security: max-age=7776000; includeSubdomains
X-FRAME-OPTIONS: SAMEORIGIN
Cache-Control: no-cache
Content-Type: text/html;charset=UTF-8
Content-Length: 7444
Date: Wed, 26 Aug 2015 15:20:26 GMT



    
[...]
function newRDP(params)
{
    // var w = 1176, h = 551, server_bpp = 16;
    // var w = 1280, h = 780, server_bpp = 16;
    //var w = 1280, h = 610, server_bpp = 16;
    var w = window.innerWidth-10, h = window.innerHeight-10, server_bpp = 16;

    var protocol = ("https:" == location.protocol) ? "wss://" : "ws://";// No I18N
    var r = svManager.getInstance(); 
    params = params + "&mapClipboard=on";//No I18N
    r = new svGlobal.Rdp( protocol + 'pmanagerpro.customer.com'+ ":"+7273+"/RDP?" + params, w, h, server_bpp);// No I18N
    //alert(params + ' ' +w + ' ' +h);
    //console.log(params + ' ' +w + ' ' +h);
[...]

want to match

'pmanagerpro.customer.com'+ ":"+7273+"/RDP?"

Wrote the stream irule

when HTTP_REQUEST {
STREAM::disable
HTTP::header remove Accept-Encoding
}

when ACCESS_ACL_ALLOWED {
STREAM::disable
HTTP::header remove Accept-Encoding
}



when HTTP_RESPONSE {

set toreplace "\'pmanagerpro.customer.com\'+ \":\"+7273+\"/RDP?"
set replacestring "\'1.1.1.1/f5-w-68747xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx$$/RDP?\'"
STREAM::disable

if {[HTTP::header Content-Type] contains "text"}{     
   STREAM::expression "@$toreplace@$replacestring@"
    STREAM::enable
log local0. "string1= $toreplace    &&&&&  string2= $replacestring"
}
}

when enabled, the logging shows the

toreplace
variable be exactly what I want to match. But the match doesn't work (client gets the original content)

Thank you

Alex