For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Avshalom_114801's avatar
Avshalom_114801
Icon for Nimbostratus rankNimbostratus
Feb 20, 2013

uncompress gzip REQUEST with JSON

I have a client app that send JSON requests to the server pool.

 

The requests are compressed with GZIP and I'm sending a Content-Encoding: gzip header.

 

F5 doesn't seem to uncompress the responses - Policy Builder cannot recognize my JSON data and I get a lot of HTTP compliance errors due to ASM looking at the compressed body instread of uncompressing it.

 

I couldn't find anything about uncompressing client requests (just an old, unanswered post from 2009). What am I missing? How can I configure ASM (or LTM) to uncompress the data before the policy is enforced?

 

dev
devops
iControl

24 Replies

Show More
  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Feb 27, 2013
    I was just wondering, I knew Apache supported compressed requests through mod_deflate but didn't know of any others, now I do. Anyway, it seems like there's no happy ending for this one unfortunately.
  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Mar 07, 2013
    I've just been browsing the iRules wiki and it would seem request compression is supported in v11, as indicated by the COMPRESS:: enable 'request' subcommand: https://devcentral.f5.com/wiki/iRules.COMPRESS__enable.ashx. No real detail on how it works but I'm sure it could be tested quite easily.
  • wsanders_233261's avatar
    wsanders_233261
    Icon for Nimbostratus rankNimbostratus
    Apr 30, 2018

    As far as I know the LTM will pass-through compression headers and compressed content unless you have an http-compression profile attached to your virtual. My F5's have enough to do without adding uncompression to their load, and, more importantly, compression seems to break chunking with some HTTP client libraries, so I have never used a http-compression profile.

     

  • Walter_Kacynski's avatar
    Walter_Kacynski
    Icon for Cirrostratus rankCirrostratus
    May 11, 2018

    There is an iRule DECOMPRESS::enable request that will accomplish this goal. I opened a support case and the engineer gave me a solution. I tested it with an LTM policy or here is the iRule:

    when HTTP_REQUEST {
  log local0. "**HTTP Request Received**"
  if { [HTTP::header "Content-Encoding"] contains "gzip"} {
    DECOMPRESS::enable request
    log local0. "Content-Encoding is GZIP, DECOMPRESS"
  }
}

    I verified that content is uncompressed.

  • vagabondino_377's avatar
    vagabondino_377
    Icon for Nimbostratus rankNimbostratus
    Nov 28, 2018

    Hi Walter please can you help me because I have used your code but it seems that it doesn't work for my web app? How can I use it? How did you verify that content of your request is uncompressed?

     

    • Walter_Kacynski's avatar
      Walter_Kacynski
      Icon for Cirrostratus rankCirrostratus
      Nov 28, 2018

      I'm not sure, it worked for me. I don't know what setup you have to steer you in the correct direction. Can you dump out some of your virtual server configuration?

       

    • vagabondino_377's avatar
      vagabondino_377
      Icon for Nimbostratus rankNimbostratus
      Nov 28, 2018

      Here is my virtual server configuration:

       

      ltm virtual d1co-collsiopeplus-a2a { address-status yes app-service none auth none auto-lasthop default bwc-policy none clone-pools none cmp-enabled yes connection-limit 0 description colla2a.siopeplus.it destination 172.23.128.93%1:https enabled fallback-persistence none flow-eviction-policy none gtm-score 0 ip-intelligence-policy none ip-protocol tcp last-hop-pool none mask 255.255.255.255 metadata none mirror disabled mobile-app-tunnel disabled nat64 disabled partition Common per-flow-request-access-policy none persist none policies { asm_auto_l7_policy__d1co-collsiopeplus-a2a { } } pool d1co-collsiopeplus-a2a profiles { ASM_d1co-collsiopeplus-a2a-443_temp { context all } d1co-collsiopeplus-a2a { context clientside } d1co-collsiopeplus-a2a-443 { context all } http { context all } tcp { context all } websecurity { context all } } rate-class none rate-limit disabled rate-limit-dst-mask 0 rate-limit-mode object rate-limit-src-mask 0 related-rules none rules { Direct_client-server_authentication d1co-siopeplus-a2a-throttle-get } security-log-profiles { local_allresp_allreq remote_allresp_allreq } service-down-immediate-action none service-policy none source 0.0.0.0%1/0 source-address-translation { pool none type none } source-port preserve syn-cookie-status not-activated traffic-classes none translate-address enabled translate-port enabled transparent-nexthop none urldb-feed-policy none vlans { D1-COLL-LB-EST-FE.128.0-23 } vlans-enabled vs-index 114 }