Forum Discussion
Tim_Brown
Nimbostratus
Nimbostratusregsub failing
I used bl0ndie's search and replace code, the short version:
when HTTP_REQUEST {
HTTP::version 1.0
}
when HTTP_RESPONSE {
HTTP::collect 4294967295
}
when HTTP_RESPONSE_DATA {
set find ":8088"
set replace ""
set payload [HTTP::payload]
if {[regsub -all $find $payload $replace new_response] > 0} {
HTTP::payload replace 0 [HTTP::payload len] $new_response
}
}
to attempt to search and replace ":8088" with "" (nothing). I've gone so far as to log the HTTP::payload after the "set payload" line and the string I'm searching for is there, but it appears as though the regsub evaluation is failing as the response never gets rewritten.
Any help here would be appreciated.
- I just tested this out and it works for me. Here are the approaches I would take if I were you:
1. If all you are doing is replacing all occurances of ":8088" with an empty string, I'd use the Stream profile (if it's available to you).
2. Add some logging to your rule to determine if it's the regsub that's not working or the the HTTP::payload replace.
3. Change your code to do a regexp with the -indices option to return the indices of the matched sections. Then do individual HTTP::payload replaces for each of those indices. This avoids having to make a copy of the entire reponse payload. Search the forums for the indices option of regexp for more info.
-Joe 
Tim_BrownJoe,
It's the logging within the regsub expression that I'm not familiar with. Can you provide some pointers?- Give this a try:
when HTTP_REQUEST { HTTP::version 1.0 } when HTTP_RESPONSE { HTTP::collect 4294967295 } when HTTP_RESPONSE_DATA { set find ":8088" set replace "" log local0. "payload: [HTTP::payload]" if {[regsub -all $find [HTTP::payload] $replace new_response] > 0} { log local0. "Match found - regsub returned greater than zero!" log local0. "New Response: $new_response" HTTP::payload replace 0 [HTTP::payload len] $new_response } else { log local0. "No match found - regsub returned zero!" } }
All the "log" statements will put the strings into the /var/log/ltm file.
*Note1 : that I removed the $payload variable to avoid an unnecessary copy of the entire payload value.
*Note2 : Make sure you remove the log commands before moving this rule into production.
*Note3 : If you have it available, I would still highly recommend using the Stream profile for this if you can. It has much less overhead on the system.
-Joe
