Forum Discussion
Side-Band HTTP Payload concern
Hello experts! I am having an issue sending a HTTP Payload to another server. My goal is to intercept a File upload and send it to another Virtual Server (which has a ASM Policy applied). The main app base64 encodes the file upload and transmits the file within a URL Form encoded post. I have an iRule which intercepts the file decodes the base64 into a variable. The issue is when I attempt to append the needed Multi Part headers and footers to the capture decoded file, the resulting file becomes unreadable.
Code
when RULE_INIT {
set static::debug 1
set static::content [ifile get ]
}
when HTTP_REQUEST {
set VirusDetected 0
set output 0
if { ([HTTP::uri] contains "") && ( [HTTP::method] eq "POST") } {
set clen [HTTP::header Content-Length]
if {$static::debug} {log local0. "Request Length $clen" }
HTTP::collect $clen
}
}
when HTTP_REQUEST_DATA {
set payload [HTTP::payload]
if {[URI::query "?$payload" ] eq "SaveAttachment" } {
set IsAdaptEnabled 1
set parametervalue [URI::query "?$payload" ]
set parametervalue [URI::decode $parametervalue]
set parametervalue [URI::decode $parametervalue]
set contenttype1 [expr { [string first "data:" $parametervalue] + 5 } ]
set contenttype2 [expr { [string first ";" $parametervalue $contenttype1] - 1 } ]
set contenttypesnip [string range $parametervalue $contenttype1 $contenttype2];
set filename1 [expr { [string first "FileName" $parametervalue] + 9 } ]
set filename2 [expr { [string first "FileSize" $parametervalue $filename1] - 2 } ]
set filenamesnip [string range $parametervalue $filename1 $filename2];
set len1 [expr { [string first "base64," $parametervalue] + 7 } ]
set len2 [expr { [string first "`" $parametervalue $len1] - 1 } ]
set filesnip [string range $parametervalue $len1 $len2];
if {[catch {b64decode $filesnip} decodedfilesfile ] == 0 and $decodedfilesfile ne ""} {
base64 decoding succeeded
} else {
base64 decoding failed
}
set decodedfilesfilelength [string length $decodedfilesfile]
if {$decodedfilesfilelength <= 20971520} {
set firstboundary "----WebKitFormBoundaryPMvLP4u7CcWWqOv7 \r\n"
set lastboundary " \r\n\r\n----WebKitFormBoundaryPMvLP4u7CcWWqOv7\r\n"
set contentdisposition "Content-Disposition: form-data; name=$filenamesnip; filename=$filenamesnip; size=$decodedfilesfilelength\r\nContent-Type: $contenttypesnip\r\n\r\n"
set payload $firstboundary$contentdisposition$decodedfilesfile$lastboundary
set s1 [call /Common/HSSR::http_req -state hstate -virt ASM_Internal_Virtual_Server -uri "http:///VirusCheck-for-filename/$filenamesnip" -method POST -body $payload -type "multipart/form-data ----WebKitFormBoundaryPMvLP4u7CcWWqOv7" -debug 1 -wait 60]
if {$static::debug} {log local0. "ASM Virtual Server Responce $s1"}
if {($s1 == 403) || ($s1 == 555)} {
set VirusDetected 1
HTTP::payload replace 0 $clen null
HTTP::release
} else {
HTTP::release
}
call /Common/HSSR::http_close hstate
} else {
HTTP::respond 200 content "$static::content" noserver
}
}
}
- PeteWhite
Employee
Why not just send the whole of the request - headers and payload. Leave ASM to unpack it.
- tiny_cloud_ninjHistoric F5 Account
The original request is not in a format which ASM can intercept for Anti-Virus scanning. The file is b64 encoded within a form parameter.
I don't get the point of
followed by a concentation of[binary scan SOMEDATA B* somevariables]
?set payload $somevariable$somevariable$b64decodedfile$somevariable
Basically this syntax is creating a string containing something like 0101010101yourbinarycontent0101010101, isn't it? Beside of this using concentation on binary data may break any binary representation (a hidden transformation to UTF-8)...
Cheers, Kai
- tiny_cloud_ninjHistoric F5 Account
Yea, The binary scan was a mistake ( I removed those commands from the above rule). You nailed the real question.. "How should an iRule be written to concat a string on either side of a binary variable". Basically; I need to forge a Mutli/Part HTTP Post to a second service using the [HTTP::payload] from the original request..
Hi Tiny Cloud Ninja,
to concentate binary data you may check out the [binary format] syntax below...
set payload [binary format A*A*A*A* $firstboundary $contentdisposition $decodedfilesfile $lastboundary]
... the syntax will create a variable
an existing UTF-8 representations (TCL=everything is UTF-8 in its primary form), but instead just a shimmered binary representation (TCL=every variable may have a second representation. In this case a binary value).without
If you pass the variable then to another command which is able to handle binary data (sideband should be fine to handle this), it would receive the binary representation...
Cheers, Kai
- Stanislas_Piro2
Cumulonimbus
ASM doesn't check antivirus but forward it to ICAP server.
Why don't you configure ICAP feature in the LTM instead of forwarding to ASM which forward to ICAP?
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com