Rewrite the post operation with a body.

Question

Hi;can you help to write the irule to rewrite the post operation (not uri redirect) with a body as below:For example:&nbsp; &nbsp; &nbsp; abc-cd.ef.com/abc/v1/jurisdict/configuration rewrite to&nbsp;cd.ef.com/abc/v1/jurisdict/configuration&nbsp;other example:&nbsp; &nbsp; &nbsp; &nbsp;abc-cd.ef.com/abc/v1/search rewrite to&nbsp;cd.ef.com/abc/v1/searchit mean =&gt; abc-cd.ef.com/abc/v1/*&nbsp; rewrite to&nbsp;cd.ef.com/abc/v1/*&nbsp;Note: this is rewrite in POST operation, it is not redirect uri.thanks a lot, i appreciate your help.

hien_truong · Accepted Answer

Hi Kerry/JRalm;The issue resolved when i changed pool members from DEX to NGINX (using the same irule) since rewrite host name locate in NGINX. Thanks a lot for your support.

jrahm · Answer

Hi&nbsp;Hien_Truong,&nbsp;it looks like you just need to rewrite the host header inbound? If you want this to be fairly dumb, you can do something like:
when HTTP_REQUEST {
  if { [HTTP::host] == "abc-cd.ef.com" } {
    HTTP::header replace Host "cd.ef.com"
  }
}
If it needs to be dynamic, there are multiple options depending on what the patterns would be. I'll assume a pattern of: nnn-cd.ef.com for the following solution:
when HTTP_REQUEST {
  # assumes that port 80 is used for http or 443 for https
  # if non-std ports, use contains instead of ends_with
  if { [HTTP::host] ends_with "-cd.ef.com" } {
    HTTP::header replace Host [getfield [HTTP::host] "-" 2]
  }
}
If this is not the actual pattern of your hosts that you want to manipulate, post back and we can work on an alternative. untested, make sure to do so in a lab.

kerry · Answer

F5 has a bug where SNI "server side" is set using the data in the client TCP packet.&nbsp; thus you migh have to set "server name" in server side SSL profiles.&nbsp; &nbsp; If you are tring to send to two different servers with different host names.&nbsp; you might need two SNI server profiles with different "server name" and use a irules to select the correct on.&nbsp;see https://support.f5.com/csp/article/K13452see https://support.f5.com/csp/article/K41600007i some times use curl on the Ff5 itself to see what the server (pool member) will and will not accpet.&nbsp; &nbsp; something like "curl -vk --header "Host: change_fqdn" --resolve old_FQDN:443:pool_member https://old_FQDN/"&nbsp; &nbsp;when this work then you know what to set in the irule.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;

hien_truong · Answer

i tried both of your irules using my browser but i get 404 return. it mean somehow it doesn't hit irule when applying it to F5 then F5 send the request to pool members and get 404 error. i also tried the below irule but still not working. i see "get" method in console. Please advise. Thanks

when HTTP_REQUEST {
if {[HTTP::method] eq "POST"}{
HTTP::header replace origin "http://123.abc.com"
HTTP::header replace referer "http://123.bcd.com"
} else { return }
}

jrahm · Answer

maybe try the serverside of the connection to update the host?
when HTTP_REQUEST_SEND {
    clientside {
        HTTP::header replace Host &lt;your desired host for server-side&gt;
    }
}

kerry · Answer

if https.&nbsp; &nbsp;you need to set the SNI values in the SSL profiles or via Irule.&nbsp; &nbsp;for testing add a log line so you know if the rules it hit and what things are being set to.&nbsp; &nbsp;also web server logs will show what being passed to it.&nbsp; &nbsp; &nbsp; &nbsp; there is a few irules examples aroubd on how to log all html headers.&nbsp;&nbsp;"host" is the header you need to changes.&nbsp; &nbsp; the two you listed are just for reference.&nbsp;&nbsp;

Forum Discussion

Rewrite the post operation with a body.

8 Replies

Recent Discussions

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Open Redirection Mitigation

F5Access | MacOS Sonoma

enable tls1.2 on management interface on F5 ltm running version 10.x

[ASM] - what is "Browser Challenge file" ?

Related Content

2. SYN Cookie: Operation

Security Operations Center - Helpers Behind the Scenes

Insights of F5 Distributed Cloud WAAP Events Export, New Operators and Trends features

Understanding GTM Wide IP Operations

A look on APT operations and using F5 BIG-IP features for mitigation