For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

HenryX_171845's avatar
HenryX_171845
Icon for Nimbostratus rankNimbostratus
Sep 29, 2014

Problem of doing both TCP and HTTP editting

In my application (vs is TCP protocol with HTTP Profile), we'd like to - 1. insert metadata per each connection using TCP profile and it's access functions 2. We also want to preserve all existing HTTP profile and manipulation as it is, for example insert XFF in example below.

 

when CLIENT_ACCEPTED { metadata could be something else set metadata [IP::client_addr] TCP::payload replace 0 0 $metadata log local0. "Inserting TCP DATA to SERVER" TCP::release }

 

when HTTP_REQUEST { HTTP::header insert XFF [IP::client_addr] log local0. "Insert XFF header to SERVER" }

 

Question is: Is this a viable approach to BIG-IP internals? In other words, once metadata inserted would it impact HTTP state processing and introduce regression problems to any extend?

 

application delivery
deployment
devops
iRules
LTM

2 Replies

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Oct 03, 2014

    What are you trying to accomplish with the TCP payload insertion?

     

    If you insert arbitrary data in the beginning of the TCP payload, you'll be prepending that data before the HTTP request line. I expect this will break the HTTP profile's parsing of the request line for the verb, URI and HTTP version. Consequently, I don't think this will work.

     

    Aaron

     

  • HenryX_171845's avatar
    HenryX_171845
    Icon for Nimbostratus rankNimbostratus
    Oct 03, 2014

    With following code, I found both TCP-INSERT and HTTP Header Insertion were successfully done (checked on receiving tcpdump).

     

    when CLIENT_ACCEPTED {
    TCP::payload replace 0 0 "TCP-INSERT"
    TCP::release
}

when HTTP_REQUEST {
    HTTP::header insert HDR "HTTP-HEADER-INSERT"
}

    Unfortunately if I add a TCP insertion fired at SERVER_CONNECTED, it show an error.

     

    I think a thorough understanding of the events and state machines internal may be very helpful to debug.

     

    Thanks for your thought.