Send Attackers IP to another system via API

Because you haven't given the complete format of the call api of curl - v and the http response header, the following code uses iRulesLX to send two https posts, which is equivalent to the effect of twice curl https formats:

1. curl -sku 'admin:xt32112300' -X POST https://www.test.com/auth/login

NGFW Cookie is in HTTP response header "Set-Cookie"

so, the next https post is bring cookie in http request header "Cookie"

2. curl -skv https://www.test.com/sample/post/json -X POST -H "Content-Type: application/json" -H "Cookie: XXXXX" -d '{"Client_address": "x.x.x.x"}'

iRules code:

when ASM_REQUEST_DONE priority 500 {
    set asmip [ASM::client_ip]
    set handle [ILX::init "ilxlab3_pl" "ilxlab3_ext"]
    if { [catch {ILX::call $handle jsonPost $asmip} result] } {
        # Error handling
        log local0.error  "Client - [IP::client_addr], ILX failure: $result"  
        return
    } else {
        # Log NGFW second https response body
        log local0. "result is $result"
        return
    }
}

iRulesLX code:

'use strict' // Just for best practices
// Import modules here
var f5 = require('f5-nodejs');
//var qs = require('querystring'); // Used for parsing the POST data querystring
const https = require('https');


// Create an ILX server instance
var ilx = new f5.ILXServer();

// This method will transform POST data into JSON
ilx.addMethod('jsonPost', function (req, res) {
  var options = {
    //hostname: '10.20.20.52',
    hostname: 'www.test.com',
    port: 443,
    path: '/auth/login',
    method: 'POST',
    auth: 'admin:xt32112300',
    rejectUnauthorized: false
  };

  var postclientip = req.params()[0];
  let httpBody = '';
  const req_post = https.request(options, (res1) => {
    console.log('statusCode:', res1.statusCode);
    console.log('header', res1.headers['set-cookie'])
    console.log(Array.isArray(res1.headers['set-cookie']))
    
    if (Array.isArray(res1.headers['set-cookie'])) {
        var ngfw_cookie = res1.headers['set-cookie']
        var post_asm_ip = postclientip
        var post_data = JSON.stringify({
            'Client_address': post_asm_ip
        });
        options.headers = {
            'Content-Type': 'application/json',
            'Content-Length': post_data.length,
            'Cookie': ngfw_cookie
        };
        options.path = '/sample/post/json';
        console.log(JSON.stringify(options));
        
        var post_req = https.request(options, (res2) => {
            res2.on('data', (d) => {
                process.stdout.write(d);
                httpBody += d;
            });
            res2.on('end', ()=> {
                console.log(`response data: ${httpBody}`); 
                res.reply(['successful', httpBody]);
            });
        });
        post_req.on('error', (e) => {
            console.log(e);
            res.reply('failed bring cookie post')
        });
        post_req.write(post_data);
        post_req.end();
        
    }});

  req_post.on('error', (e) => {
        console.error(e);
  });
  req_post.end();
  // Turn postData object into JSON and return to TCL
  
});

//Start the ILX server
ilx.listen();