POP & IMAP Username Re-writes

LTM doesn't currently support native parsing of POP or IMAP, so you'd need to handle this as raw TCP traffic. If you'd like to see F5 add this support, you could open a request for enhancement case. It would certainly make this scenario easier to handle if there were native events and commands for POP and IMAP.

 

 

You could potentially enable the stream filter in CLIENT_ACCEPTED, use a regex in the stream expression which matches on user and ends with either @ or what would come after the user name if it didn't have the proper termination and then rewrite that in STREAM_MATCHED using STREAM::replace if the domain wasn't already there. I'm not sure you could disable the stream filter if multiple rewrites per connection are potentially required. I can't think of a simple way to trigger re-enabling of it after the first match.

 

 

If the stream filter/iRule doesn't work, another option might be to collect the payloads using TCP::collect (for cleartext traffic) or SSL::collect. Spark posted an example of SSL::collect recently in this post:

 

 

http://devcentral.f5.com/Community/GroupDetails/tabid/1082223/aff/5/afv/topic/aft/1174753/afc/1201203/Default.aspx

 

 

Aaron