For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

HenryX_171845's avatar
HenryX_171845
Icon for Nimbostratus rankNimbostratus
Sep 26, 2014

Problem of TCP editing in BIG-IP VE

I'm running AWS m3.large instance of VE: BIG-IP 11.5.1 Build 0.4.110 Engineering Hotfix.

 

It is okay to run HTTP::header insert in iRule, but TCP::option set, or TCP::payload replace, ... always fail with funky errors complaining - Illegal argument.

 

My question is - Does VE support TCP editing at all?

 

It seems a proper Linux KLM may be needed for this feature to work in VE.

 

Is there a document listing all the feature discrepancies between HW and VE in detail?

 

Thanks,

 

Henry

 

3 Replies

  • Arnaud_Lemaire's avatar
    Arnaud_Lemaire
    Icon for Employee rankEmployee
    Sep 26, 2014

    yes there is an official document on that : http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ve-unsupported-features-matrix-1-0-0.html

     

    which is not listing any of you problem. My two cents on them, the first one TCP option set could be understandable, you don't control the TCP stack this is up to the hypervisor.

     

    the second one should be working, a least it's working on every SE vmware workstation as we are playing from time to time with it.

     

    could you share your irule to test ?

     

  • henryshaw_16675's avatar
    henryshaw_16675
    Icon for Nimbostratus rankNimbostratus
    Sep 26, 2014

    Yes, I had seen http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ve-unsupported-features-matrix-1-0-0.html But there isn't anything specific to me.

     

    I'm not confident that VE could do "TCP::option set ..." without an upgrade of BIG-IP VE. If that is correct, would F5 provide an VE upgrade (with driver) to address this?

     

    Secondly I managed to use "TCP::payload replace 0 0 <...>" inserting content right after TCP header, but unexpectedly in the stream received by client (direction: server=>bigip=>client), I was using SERVER_CONNECTED event simply as:

     

    when SERVER_CONNECTED { TCP::payload replace 0 0 "deadbeef" TCP::release }

     

    But I meant to insert content to server.

     

    Thanks!

     

  • HenryX_171845's avatar
    HenryX_171845
    Icon for Nimbostratus rankNimbostratus
    Sep 28, 2014

    Using TCP profile, I could insert to either SERVER or CLIENT per connection.

     

    An example iRule of concept would be:

     

    when CLIENT_ACCEPTED { set clientip [IP::client_addr] TCP::payload replace 0 0 $clientip log local0. "Inserting TCP DATA to SERVER" TCP::release log local0. "Releasing TCP DATA - necessary" }

     

    when SERVER_CONNECTED { set serverip [IP::server_addr] TCP::payload replace 0 0 $serverip log local0. "Inserting TCP DATA to CLIENT" TCP::release log local0. "Releasing TCP DATA - necessary" }

     

    My original idea was to argument TCP::option per packet for the connection, it seems I'm out of luck here with VE.