For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

avi_krivorot_73's avatar
avi_krivorot_73
Icon for Nimbostratus rankNimbostratus
Feb 02, 2007

Modifying SIP VIA header

Hi,

 

 

When we get a SIP INVITE from someone, the F5 always appends something to the reply message (TRYING) in the VIA header, see example:

 

 

 

Original INVITE:

 

 

Via: SIP/2.0/UDP 208.71.172.16:5060;branch=z9hG4bK-76ff6f00ffffff10ff000018ff2fff20

 

 

Reply TRYING:

 

 

Via: SIP/2.0/UDP 208.71.172.16:5060;branch=z9hG4bK-76ff6f00ffffff10ff000018ff2fff20;received=208.71.172.12

 

 

I need to strip the extra information ";received=208.71.172.12".

 

 

I noticed there is an iRule function for this. Does anyone know how this is done?

 

 

application delivery
dev
devops
iRules

5 Replies

  • Dave_Wiley's avatar
    Dave_Wiley
    Icon for Nimbostratus rankNimbostratus
    Feb 04, 2007
    You could just do a findstr on the UDP::Payload for the "received" text and remove it from the packet.
  • avi_krivorot_73's avatar
    avi_krivorot_73
    Icon for Nimbostratus rankNimbostratus
    Feb 05, 2007
    thanks for the information, although this packet is still part of the sip signaling, not the payload. Can i still use the UDP::Payload?

     

     

    And if yes, could you point me twards some good documents about this function (or perhaps a small example)? i have not writen any iRules yet, but am a quick learner.

     

     

    Thanks.

     

    Avi
  • Tao_Liu_90341's avatar
    Tao_Liu_90341
    Historic F5 Account
    Feb 05, 2007
    First of all, string ";received=xxx" was added by the server behind F5 box, NOT Bigip.

    Certainly, Bigip can help you remove that string in the response, the basic idea is to find the occurrence in UDP payload and remove it, an example:

    
rule xxx {
    when SERVER_DATA {
        if {[regexp -indices {(;received=[0-9.]+)} [UDP::payload] location] == 1} {
            set offset [lindex $location 0]
            set len [expr [lindex $location 1] - [lindex $location 0] + 1]
            UDP::payload replace $offset $len ""
         }
    }
}

    You should be able to find more in iRULE doc
  • Al_Walter_10251's avatar
    Al_Walter_10251
    Icon for Nimbostratus rankNimbostratus
    Mar 13, 2007
    What version of code are you running? Here is what I get if I tried your sample:

     

     

    01070151:3: Rule [SIP_NAT_iRule] error:

     

    line 1: [unknown event (SIP_RESPONSE)] [when SIP_RESPONSE {

     

    }]
  • avi_krivorot_73's avatar
    avi_krivorot_73
    Icon for Nimbostratus rankNimbostratus
    Mar 13, 2007
    I am running 9.4. I'm not sure if your version supports this.

     

     

    But what i had to do to get SIP working was configure SIP Persistance under Profiles. Just create one with SIP as the type.

     

     

    Then you need to assign this to your virtual server. Once i did this, all started to work well.